Answered by IgnacioAlvarezArenas:
The default password of the App Service Certificate when exported as PFX is empty, but as you say you cannot import it to the Application Gateway as it needs a password (other services in Azure do too). In order to change it, you can run this commands with OpenSSL (download: https://wiki.openssl.org/index.php/Binaries):
Export the PFX and private key to .pem:
openssl pkcs12 -in .\old.pfx -out old.pem -nodes
Then create a new PFX:
openssl pkcs12 -export -out .\new.pfx -in old.pem
In Windows you can import it in your machine, mark the key as exportable when importing it (there is a menu for this), and then after installing it locally, export it. Make sure to click in "export private key"