Certificate Chain Failing and getting 502 Bad Gateway - azure

Question

I have been given a certificate.crt, intermediate.crt, root.crt and a private key. I created a new certificate file by merging the intermediate and root together and I have run the following command to convert them into a PFX which seems to have worked.
openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt -certfile rootca.crt
I have then uploaded the PFX to an Azure application gateway. When I attempt to go to the URL, I get the following error 502 Bad Gateway.
When checking the health of the gateway I get the following error:
The root certificate of the server certificated used by the backend does not match the trusted root certificate added to the application gateway. Ensure that you add the correct root certificate to whitelist the backend.
The issue I'm having is that I do not have access to the Linux backend server and I'm not confident with Linux either, so I am not sure whether the certificate has been created correctly on the backend. My question is, have I created the certificate correctly using the OPENSSL command mentioned above?

Answer 1

I tried to reproduce the same issue in my environment and got the expected results.
Created the certificates using PowerShell commands given below
Step-1
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-Subject "CN=P2SRootCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign
Step-2
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-Signer $cert -TextExtension #("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
After Running the commands the certificate will be created as below
Click Windows + r and run the below command → Click Ok
certmgr.msc
Goto → Personal → certificates→ Right click on the certificate you want to export and Goto All tasks as below
We need both CER & PFX certificated to be exported
For CXR certificate after clicking on Export→Next→ Select No→Select Base-64 encoded x.509(CER) click on Next→Select folder location and folder name → Clik on finish.
For PFX certificate after clicking on Export→Next→Select Yes→ Select Export all extended properties with other options by default click on Next→Click on Password Checkbox and enter the password Click on Next→Select folder location and folder name → Click on finish
I have created the application gateway and I have imported the certificate
I am able to access the URL.
Reference taken from MS-Doc