Fallo al cargar certificados en application gateway

Question

Fallo al cargar certificados en application gateway

Amg 40

Buenos días,

Cuando cargo en el listener el pfx y en el backend setting Backend server’s certificate is issued by a well-known CA, Si, me aparece el siguiente error en el backend health

The Intermediate certificate is missing from the backend server chain. Please ensure that the certificate chain is complete and correctly ordered on the backend server.

Si marco en el backend setting Backend server’s certificate is issued by a well-known CA No y cargo el .CE me aparece el siguiente error

Failed to save configuration changes to application gateway 'XXXXX'. Error: Data for certificate rg-XXXXXX XXX/providers/Microsoft.Network/applicationGateways/XXXXX/trustedRootCertificates/xxxxx>xxxxxxx/xxxxxxx is invalid.

Alguien me puede ayudar a entender porqué ocurre esto.

Gracias

Saludos

G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-07-30T22:06:59.3433333+00:00

Hi Antonio Marin Garcia

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.
Amg 40 Reputation points

2025-07-31T06:09:02.7966667+00:00

Hola, si he revisado pero continua sin funcionar. Podemos dar por resuelto el caso. Gracias

Saludos
G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-07-31T17:21:18.0466667+00:00

Hola, Antonio Marin Garcia

Disculpa por las molestias ocasionadas. ¿Podrías indicarme cómo se resolvió el problema?"
Amg 40 Reputation points

2025-08-01T06:00:02.4733333+00:00

Hola, no se ha resuelto. Parece fallo del certificado. Saludos
G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-08-05T20:32:58.8966667+00:00

Hola

Disculpa por la demora,

te recomendamos verificar si tu certificado es de una CA bien conocida (como DigiCert, GlobalSign, etc.), lo mejor es:

Establecer "El certificado del servidor backend es emitido por una CA bien conocida"

en Sí.Asegúrate de que tu servidor backend envíe la cadena completa de certificados durante el apretón de manos TLS.

Asegúrate de que el archivo .cer sea un certificado raíz válido de la CA que emitió el certificado de tu servidor.

Puedes descargar el certificado raíz correcto desde el sitio web de la CA (por ejemplo, DigiCert, Sectigo).

Asegúrate de que esté en formato X.509 codificado en Base64 (.CER).

Por favor, házmelo saber si tienes más preguntas, estaremos encantados de ayudar.
G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-08-06T22:03:23.75+00:00

Hello

I wanted to follow up and check if you had the opportunity to review the information in our previous post.

Kindly let us know if the above helps or you need further assistance on this issue.

1 answer

Your answer

G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-07-30T22:06:59.3433333+00:00

Hi Antonio Marin Garcia

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.
Amg 40 Reputation points

2025-07-31T06:09:02.7966667+00:00

Hola, si he revisado pero continua sin funcionar. Podemos dar por resuelto el caso. Gracias

Saludos
G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-07-31T17:21:18.0466667+00:00

Hola, Antonio Marin Garcia

Disculpa por las molestias ocasionadas. ¿Podrías indicarme cómo se resolvió el problema?"
Amg 40 Reputation points

2025-08-01T06:00:02.4733333+00:00

Hola, no se ha resuelto. Parece fallo del certificado. Saludos
G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-08-05T20:32:58.8966667+00:00

Hola

Disculpa por la demora,

te recomendamos verificar si tu certificado es de una CA bien conocida (como DigiCert, GlobalSign, etc.), lo mejor es:

Establecer "El certificado del servidor backend es emitido por una CA bien conocida"

en Sí.Asegúrate de que tu servidor backend envíe la cadena completa de certificados durante el apretón de manos TLS.

Asegúrate de que el archivo .cer sea un certificado raíz válido de la CA que emitió el certificado de tu servidor.

Puedes descargar el certificado raíz correcto desde el sitio web de la CA (por ejemplo, DigiCert, Sectigo).

Asegúrate de que esté en formato X.509 codificado en Base64 (.CER).

Por favor, házmelo saber si tienes más preguntas, estaremos encantados de ayudar.
G Sree Vidya 4,005 Reputation points Microsoft External Staff Moderator

2025-08-06T22:03:23.75+00:00

Hello

I wanted to follow up and check if you had the opportunity to review the information in our previous post.

Kindly let us know if the above helps or you need further assistance on this issue.

Answer 1

Hello Antonio Marin Garcia

We understand that you are facing issues with uploading a .pfx certificate to your application gateway, particularly regarding the certificate chain and configuration errors.

Please check the below details to resolve the issue:

To fix this, bundle the PFX to include the leaf, intermediate, and root cert (in that order) and put on the backend target.

From: https://learn.microsoft.com/en-us/azure/application-gateway/certificates-for-backend-authentication#export-trusted-root-certificate-for-v2-sku https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-backend-health-troubleshooting#trusted-root-certificate-mismatch

For Application gateway V2, a trusted root certificate is required to allow backend instances. The root certificate is a Base-64 encoded X.509(.CER) format root certificate from the backend server certificates. You can export the public key from the TLS/SSL certificate for the backend certificate and then export the root certificate of the trusted CA from the public key in base64 encoded format to get the trusted root certificate. The intermediate certificate(s) should be bundled with server certificate and installed on the backend server.

If the back-end certificate is issued by a well-known certificate authority (CA), you can select the Use Well Known CA Certificate check box, and then you don't have to upload a certificate.

Not having the intermediate bundled in the PFX, can stop the "well known CA" from working correctly.

Try checking the intermediate certs on the backend cert. Here is an online tool for checking SSL certificates. Incorrectly Bundled Cert would show something like the one below:

A Properly Bundled Cert would show something like the one below:

The order should be leaf, intermediate, root. The rebundled PFX can be put on the appgw listener (renew/replace the one that is there) and then put on the backend as well.

How to rebundle the PFX manually to ensure it's in the right order:

First create a private.key like so from the PFX openssl pkcs12 -in Certificate.pfx -nocerts -out private.key

Then create a CER Bundle of the entire chain ensuring that they are bundled in the correct order: Creating a .pem with the Private Key and Entire Trust Chain https://www.digicert.com/kb/ssl-support/pem-ssl-creation.htm

Then recreate the PFX from the bundled CER and private key from step 1 Create a PFX from the PEM like so: https://www.ssl.com/how-to/create-a-pfx-p12-certificate-file-using-openssl/

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

Share via

Fallo al cargar certificados en application gateway

1 answer

Your answer