Share via

SSL Import Error on Application Gateway LB

SHK 0 Reputation points
2026-01-21T08:36:06.0933333+00:00

Hello,

I wanted to add SSL to the Application Gateway I created. I exported the SSL certificate using a p7b file and uploaded the root certificate, intermediate certificate, and regular certificate. However, I received an error. The error image is below. Does anyone have any information about this error?
Screenshot 2026-01-21 113353

Azure Web Application Firewall

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. Ganesh Patapati 11,835 Reputation points Microsoft External Staff Moderator
    2026-01-21T09:03:14.6433333+00:00

    Hello SHK

    Verify that the self-signed certificate you're using includes the BasicConstraintsOid extension with value "2.5.29.19" and the CA flag set to TRUE. This extension indicates that the certificate subject can act as a Certificate Authority.

    To check the certificate properties, you can use the following OpenSSL command:

    Bash

    openssl x509 -in certificate.pem -text -noout

    Look for the "Basic Constraints" section in the output, which should show "CA:TRUE" for a valid CA certificate. For detailed guidance on generating self-signed client certificates, see trusted client certificates.

    Please validate these below check points :

    1. Ensure that the certificates you're using (root, intermediate, and regular) are all in the correct format. For Application Gateway, root certificates need to be in .cer format, while the SSL certificate itself can be a .pfx file.
    2. Check the Certificate Chain: It's important that the chain of certificates is correctly ordered and complete. The leaf certificate must be the first in the chain, followed by the intermediate, and then the root certificate. Make sure all necessary certificates are present and in the correct order.
    3. Common Name Match: Confirm that the common name (CN) of the SSL certificate matches the hostname that's being used in the requests to your Application Gateway. If you're using HTTPS for the backend settings, this match is crucial.
    4. Allowed Certificates for Backend Pool: If you're connecting to an internal load balancer (ILB) or using an App Service Environment (ASE), the backend server must also have a valid SSL certificate that's recognized by Azure.
    5. Upload Root Certificate: If you're using a self-signed certificate or a certificate from a private CA, ensure that the root certificate is uploaded to the Application Gateway's backend settings.
    6. The error message you provided suggests that there might be an issue with the root CA being recognized. Make sure to upload only one root CA, as multiple entries may lead to confusion.

    Reference document :

    Can you please update us if the action plan provided was helpful?

    Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

    Please upvote if you found the information helpful. This will help us and other members of the community as well

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.