Getting HTTP 502 Error when trying to access Azure Functions behind Application Gateway

Question

I will start with the previous (working) setup. I have a couple of Azure Functions. I added APIManagement in front of that to redirect all of the Functions endpoint into a single endpoint provided by APIM. That works well without hassle.

Now I am adding Application Gateway in front of APIM and my intention is to manage the web-traffic workload in a single place. The Application Gateway itself has been configured with three health probes (gateway, developer, and management). And I also added all three (AppGateway, APIM, Functions) into the same Virtual Networks instance. Each of them assigned a separate Subnet, though. To summarize, the Virtual Network now contains:

Application Gateway --> APIM --> Functions

Now I cannot access the endpoint anymore. I kept getting HTTP Error 502 notresolvable.

This is relatively new to me so somewhere there has to be a misconfiguration.

Answer 1

Hello @FlyingInCloud ,

I understand that you were getting HTTP 502 Error when trying to access Azure Functions behind Application Gateway.

We validated that your configuration matches to the one described in the below doc:
Refer : https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-integrate-internal-vnet-appgateway

We also validated that you you've created DNS A-records mapping each of the API Management endpoint host names that you configured to the application gateway's static public IP address which ensures that the host name header and certificate sent to Application Gateway and forwarded to API Management are ones that API Management recognizes as valid.

Later we checked the backend health status of your Application gateway and it was showing healthy, however, you noticed that when you send a request via postman, a specific error "Unable to verify the first certificate" appears.

Requested you to refer the below troubleshooting doc and validate your configuration again:
Refer : https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-troubleshooting-502

You found that this issue was caused due to other certificates overriding the Issuer CN. So, when the Issuer is correct everything works as intended. And you have now managed to resolve the issue.

For more information, I'm sharing the below doc which talks about some certificate related issues that you can come across when working with Azure Application gateway:
https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-backend-health-troubleshooting#backend-server-certificate-invalid-ca

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.