Front Door Health Probe: CertificateError During Intermittent TLS Handshake — Causes and Troubleshooting

Question

Front Door Health Probe: CertificateError During Intermittent TLS Handshake — Causes and Troubleshooting

sanjay-5456 0

Problem description

I am experiencing intermittent CertificateError messages during Azure Front Door health probes against my Azure App Service origins. The issue started around 28 October 2026, with the health probes failing intermittently with CertificateError, even though normal traffic and manual TLS tests succeed. The probes happen during the TLS handshake before the health check path is evaluated, indicating a possible TLS certificate validation issue.

Environment

Azure Front Door Standard and Premium deployment; Azure App Service origins in both production and non-production environments; using HTTPS on port 443; Azure-managed certificates; hostname and host header set to *.azurewebsites.net; no custom domains involved.

What I've already tried

I verified that the origin hostname and host header match, and that HTTPS on port 443 is used with certificate name validation enabled. I also confirmed via manual TLS validation from a jump server that the TLS handshake succeeds and the certificate chain is complete and matches expected values. Additionally, I observed that the leaf certificate remains consistent across multiple TLS handshake attempts, and normal requests still return HTTP 200 responses despite the probe failures.

Current status

The issue persists with intermittent CertificateError during health probes, despite the origin being Azure App Service with default hostname and Azure-managed certificates. I am seeking guidance on diagnosing the root cause of these intermittent TLS handshake failures and recommendations for resolving the CertificateError during health probes.

0 comments

1 answer

Your answer

Answer 1

Hemant Bharadwaj 370 Microsoft Employee

Thanks for the detailed report. A practical way to isolate this is:

In Front Door origin settings, verify the Origin host header exactly matches a hostname included in the origin certificate CN/SAN.
1. Confirm the probe endpoint is HTTPS, publicly reachable from Front Door, and does not redirect to auth.
2. 1. Validate the origin serves the full certificate chain at all times.
  2. 1. Review Front Door health probe settings and origin configuration:
    2. - https://learn.microsoft.com/azure/frontdoor/health-probes
      - https://learn.microsoft.com/azure/frontdoor/origin
    - - https://learn.microsoft.com/azure/frontdoor/end-to-end-tls
      - If the issue remains intermittent, collect Front Door diagnostics for the failing time window and open an Azure support request:
        
        https://learn.microsoft.com/azure/azure-portal/supportability/how-to-create-azure-support-request
        
        Validation:
        
        Origin health in Front Door stays healthy.
        - - No repeated TLS/certificate probe failures. - “If you find this answer helpful, please upvote it. If this resolves your issue, please mark it as the accepted answer so that it can help others in the community.”

Sanjay kumar 40 Reputation points

2026-10-30T12:14:59.0166667+00:00

Thanks for the recommendations. We have already completed the following checks:

Origin hostname and host header: Both are configured with the default azurewebsites.net hostname and match the certificate's CN/SAN.

HTTPS connectivity: Front Door origin is configured on HTTPS port 443. We have also verified connectivity from the jump server.

Certificate chain: We ran five consecutive TLS tests against the Private Link IP using the App Service hostname as SNI. All five returned Verify return code: 0 (ok), with identical certificate chain entries.

Origin configuration and diagnostics: We reviewed the Front Door origin and health probe configuration and collected Front Door health probe and access logs. However, intermittent CertificateError alerts continue.

Microsoft Support: We raised support ticket 2610290040004211, but the issue remains unresolved. Due to our Developer Support plan, Microsoft redirected us to the public Q&A platform for further investigation.

Since the issue persists despite these checks, could you please help investigate certificate validation from the Front Door side and identify why the health probes intermittently return CertificateError?

Note: Our origin uses Private Link, so public reachability is not applicable to this configuration.