Static web App - custom domain + SSL certificate

Question

My purpose is the setup of SSL between an external WAF (residing on the internet) and a static web App (residing behind a L4 Azure public load balancer). The network path is like this:

Third party WAF --> Azure Public LB (L4) --> Firewall (VM) --> Static WebApp

By default Static Web App gets .azurestaticapps.net as domain, but i cannot rely on this because i cannot control the public IP associated with it. What i need is a custom domain so i can control public DNS mapping between the custom domain that i own (i.e. sub.example.com) and the static pip configured on the Public load balancer (pip_AzureLB):

WAF --> public DNS (sub.example.com A pip_AzureLB) - DNS discovery for sub.example.com

WAF --> AzureLB --> Firewall --> StaticWebApp - network path

WAF --(SNI=sub.example.com)--> StaticWebApp - SSL certificate request

WAF <--(CN=sub.example.com)-- StaticWebApp - SSL server certificate

because i own the public domain example.com i have full control of:

• public A record configured on public DNS
• certificate signing and renewal of *.example.com

is it possible to have the scenario above for Static Web App? I see it does apply for App Service. But what happen if the above is not the way?

thanks

Answer 1

Hi MrcFn,

Azure Static Web Apps are designed to be served through Azure's global Content Delivery Network (CDN), and they do not support being placed behind an Azure Load Balancer, firewall, or private networking infrastructure. The platform does not expose a fixed public IP that you can reference in your DNS A records or route traffic to directly.

Moreover, Static Web Apps handle SSL termination at Azure’s edge, and cannot negotiate SSL certificates using SNI from a downstream device such as your WAF. Therefore, your desired network path cannot be implemented using Static Web Apps.

To achieve your objectives, we recommend two alternative approaches depending on your priorities.

1. Use Azure Front Door in front of your Static Web App. Azure Front Door supports custom domains, bring-your-own (BYO) SSL certificates through Azure Key Vault, and integrates natively with Static Web Apps.
   • In this model, you can configure your DNS to point sub.example.com to your Front Door endpoint. Front Door will handle SSL termination and route traffic securely to the Static Web App. You can optionally enable WAF policies directly on Azure Front Door for complete traffic inspection and protection.
     Custom domain for Azure Static Web Apps
     Azure Front Door – Custom domain and HTTPS.
2. If your architecture requires full control over network routing, public IPs, and TLS handshakes, including support for SSL negotiation using your own certificates from the WAF to the backend, you should consider using Azure App Service instead of Static Web Apps.
   • Azure App Service supports VNet integration, can operate behind an Azure Load Balancer and firewall, and allows you to bind custom domains and certificates for direct SSL handling. This model supports your need for strict path-based routing and TLS control. Add SSL certificate to App Service
     Integrate App Service with VNet.

Hope this helps, if you have any further concerns or queries, please feel free to reach out to us.