Azure Application Gateway Backend Health

Question

I have just created my first application gateway. There is an error for the backend health. The error reads "The Intermediate certificate is missing from the backend server chain. Please ensure that the certificate chain is complete and correctly ordered on the backend server" On the backend server, I had created a self-signed certificate (with just the name of the server). It looks like there is an intermediate certificate that corresponds to the certificate that I created, but we have this error. Any ideas how to overcome this?

Answer 1

Hello Joshua,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

It sounds like you're hitting a snag with your Application Gateway's backend health due to a missing intermediate certificate. Here's how you might go about resolving this:

Steps to Troubleshoot:

1. Certificate Chain Validation:
   • Make sure that the certificate chain is complete on your backend server. This means that if you have a self-signed certificate, also ensure that the intermediate certificates (if any) are correctly installed on the backend server. The chain should include the root CA, the intermediate CA(s), and finally your server certificate.
2. Intermediate Certificates:
   • If you generated the certificate yourself, ensure that you have exported the intermediate certificate properly. Often, self-signed certificates are only the leaf (server) certificate, missing the necessary intermediates that form the complete chain.
3. Reconfigure the Backend Settings:
   • In the Application Gateway configuration, double-check your backend HTTP settings. Ensure that the correct protocol (HTTPS) and port (default is 443) are being used, and that SSL settings are properly configured.
4. Health Probes:
   • Verify that your health probe settings are correctly set to use HTTPS and that you have specified the right host name or path that the probe should check. You can access the health probe settings through the Azure portal under the Application Gateway resources.
5. Diagnostics:
   • Use the Application Gateway diagnostics to run a health check on your backend pool. You can access this through the 'Backend health' tab in the Azure portal. This will provide insights if there are any specific misconfigurations or certificate issues.
6. Use Command Line:
   • You can also utilize Azure CLI or Azure PowerShell to check backend health for more detailed diagnostics. For example:
     • Azure CLI:

       
              az network application-gateway show-backend-health --resource-group <YourResourceGroup> --name <YourGatewayName>
       
       

     • PowerShell:

       
              Get-AzApplicationGatewayBackendHealth -Name <YourGatewayName> -ResourceGroupName <YourResourceGroup>
       
       

Additional Considerations:

• Ensure there are no network security groups (NSGs) or routing problems that might be blocking the communication between the Application Gateway and your backend server.
• If you are using a self-signed certificate for a production environment, you might want to consider transitioning to using a certificate issued by a trusted certificate authority for better security and compatibility.

I hope these steps help you get your Application Gateway up and running! If you have any more questions, feel free to ask.

References:

• Troubleshoot backend health issues in Application Gateway
• Application Gateway Backend Health Overview
• Using Azure CLI to check backend health
• Using PowerShell to check backend health