facing the issue with Azure front door getting 502 error (selfsigned certificate error)

Question

facing the issue with Azure front door getting 502 error (selfsigned certificate error)

Joshua Moniz 0

I have deployed a virtual machine in the UAE North (Region 1) with two load balancers: one regional and one global. I am attempting to integrate these with Azure Front Door. After verifying the domains, I obtained an endpoint. However, when accessing the endpoint or domain name, I encounter a 502 error with the following details:

Error Info: OriginCertificateSelfSigned x-azure-ref ID: 20250820T163509Z-16cfbd67955ztgr8hC1MAAdyaw000000021g000000003hz2

Joshua Moniz 0 Reputation points

2025-08-21T06:48:54.6933333+00:00

Can we discuss this over call ?
Anonymous

2025-08-21T16:47:02.97+00:00

Hello Joshua Moniz

Sure! we have initiated the private message. Could you please check and confirm?
Anonymous

2025-08-22T22:18:05.2366667+00:00

Hi Joshua Moniz

We have Additionally checked and confirmed that A self-signed certificate cannot be used for Azure Front Door origin configurations.

Azure Front Door only accepts certificates issued by a trusted Certificate Authority (CA) from the Microsoft Trusted CA List, so a self-signed certificate will not work,

Check the below public document for more understanding: https://learn.microsoft.com/en-us/azure/frontdoor/end-to-end-tls?pivots=front-door-standard-premium#backend-tls-connection-azure-front-door-to-origin

Do let me know if you have further questions! We will be happy to assist.
Anonymous

2025-08-25T18:34:28.8533333+00:00

Hi Joshua Moniz

I am following up on this thread and wanted to check if you had a chance to review the information we posted in the comments.

Please do let me know if you have any questions, we will be happy to assist you.
Anonymous

2025-08-26T17:13:55.75+00:00

Hi Joshua Moniz

Just checking in to see if posted information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

Your answer

Joshua Moniz 0 Reputation points

2025-08-21T06:48:54.6933333+00:00

Can we discuss this over call ?
Anonymous

2025-08-21T16:47:02.97+00:00

Hello Joshua Moniz

Sure! we have initiated the private message. Could you please check and confirm?
Anonymous

2025-08-22T22:18:05.2366667+00:00

Hi Joshua Moniz

We have Additionally checked and confirmed that A self-signed certificate cannot be used for Azure Front Door origin configurations.

Azure Front Door only accepts certificates issued by a trusted Certificate Authority (CA) from the Microsoft Trusted CA List, so a self-signed certificate will not work,

Check the below public document for more understanding: https://learn.microsoft.com/en-us/azure/frontdoor/end-to-end-tls?pivots=front-door-standard-premium#backend-tls-connection-azure-front-door-to-origin

Do let me know if you have further questions! We will be happy to assist.
Anonymous

2025-08-25T18:34:28.8533333+00:00

Hi Joshua Moniz

I am following up on this thread and wanted to check if you had a chance to review the information we posted in the comments.

Please do let me know if you have any questions, we will be happy to assist you.
Anonymous

2025-08-26T17:13:55.75+00:00

Hi Joshua Moniz

Just checking in to see if posted information was helpful. If you have any further updates on this issue, please feel free to post back.

Answer 1

Hello Joshua Moniz

We understood that you are facing 502 error when trying to access your Azure Front Door endpoint, specifically related to a self-signed certificate.

Azure Front Door requires that the origin server presents a valid SSL certificate signed by a trusted Certificate Authority (CA). If the origin uses a self-signed certificate, Front Door cannot validate it, resulting in the OriginCertificateSelfSigned error.

Kindly verify the below details and confirm:

Ensure that the certificate being used on your backend matches the fully qualified domain name (FQDN) configured in Azure Front Door. If you're using a self-signed certificate, consider switching to one issued by a trusted Certificate Authority (CA).
Change the host header in Azure Front Door to use the domain name instead of the IP address. This ensures proper SNI (Server Name Indication) handling during TLS handshake.
If using a self-signed certificate is necessary, you can disable the EnforceCertificateNameCheck setting. In the Azure portal, navigate to your Azure Front Door profile, and toggle this setting off under the origin settings.
Make sure that your Azure Front Door routing rules are correctly set up to point to the right backend, and that you've added a routing rule for your custom domain if needed.

I hope it helps! Please let us know do you have any further queries.

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.