--- cuppy_hub: azure cuppy_path: reference/application-gateway/errors.md cuppy_section: docs cuppy_doc: 0K4Q-8BY8 cuppy_doc_uuid: 65f1d39b-5936-4210-8402-4e44cc9f0c3d cuppy_permalink: https://cuppy.io/azure/d/0K4Q-8BY8 cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/application-gateway/errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: add30b988f21f5a7971ff65ca51b6ae6ebdb0b8deb3251cae98e2b77234e5627 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Application Gateway and WAF errors **Application Gateway v1 retired on April 28, 2026**: everything here is v2 (`Standard_v2`, `WAF_v2`). TLS 1.0 and 1.1 were removed from its TLS policies in 2025; use a current predefined or custom policy. **Start every 502 with backend health:** ```bash az network application-gateway show-backend-health -g -n \ --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{address:address, health:health, log:healthProbeLog}" -o table ``` ## Backend health messages (v2) | Message | Cause → fix | |---|---| | `Time taken by the backend to respond to application gateway's health probe is more than the timeout threshold in the probe setting.` | Slow backend or probe path: make the path cheap, or raise the probe timeout | | `Application Gateway could not create a probe for this backend. This usually happens when the FQDN of the backend is not entered correctly.` | Wrong FQDN, or the gateway's VNet DNS can't resolve it (private endpoints need the zone linked to the gateway's VNet) | | `Application Gateway could not connect to the backend. Check that the backend responds on the port used for the probe. Also check whether any NSG/UDR/Firewall is blocking access to the Ip and port of this backend.` | Nothing listening on that port, or an NSG, UDR or firewall between gateway subnet and backend | | `Status code of the backend's HTTP response didn't match the probe setting. Expected:{…} Received:{…}.` | The probe path returns 401, 403, 404 or a redirect. Point the probe at an anonymous health path, or widen the accepted status codes. API Management backends: probe `/status-0123456789abcdef` | | `Body of the backend's HTTP response didn't match the probe setting. …` | The probe's body match string isn't in the response | | `The Common Name of the leaf certificate presented by the backend server does not match the Probe or Backend Setting hostname of the application gateway.` | The host name the gateway sends (backend setting or probe) differs from the certificate's CN/SAN. For App Service, use **pick host name from backend target** | | `The Intermediate certificate is missing …` / `The Leaf certificate is missing …` / `The Leaf certificate isn't the topmost certificate …` | The backend serves an incomplete or misordered chain: fix the chain on the server | | `The backend Server certificate isn't signed by a well-known Certificate Authority (CA). …` / `… not signed by any root certificates uploaded …` | Private CA: upload its root to the backend setting's trusted root certificates | | `Backend certificate is invalid. Current date isn't within the "Valid from" and "Valid to" date range on the certificate.` | Expired backend certificate | | `Backend server certificate isn't allow-listed with Application Gateway.` | The authentication or trusted root certificate on the backend setting doesn't match the server's | | `The backend health status could not be retrieved. …` | The gateway subnet's NSG or UDR blocks the management range (**inbound 65200–65535 from `GatewayManager`** on v2), or the backend FQDN doesn't resolve. v2 refuses such an NSG rule with `ApplicationGatewaySubnetInboundTrafficBlockedByNetworkSecurityGroup` | ## 502 when backends look healthy - The **request** goes somewhere the probe doesn't: a different host header, path or listener/rule misconfiguration. - **Asymmetric routing:** the response returns through an NVA, firewall or gateway route instead of the gateway. - **Capacity:** `CapacityUnits` at the autoscale ceiling; raise the maximum. - **App Service backends:** host-header mismatch, or App Service access restrictions that don't allow the gateway's subnet (service endpoint) or IP. - **Empty pool**, or the gateway stopped or in a `Failed` provisioning state. - 504: the backend took longer than the backend setting's request timeout. ## WAF 403s The 403 body names `Microsoft-Azure-Application-Gateway/v2`. With the OWASP Core Rule Set, the WAF uses **anomaly scoring**: matching rules add to a score, and at **5 or more** the request is blocked (Prevention mode) or only logged (Detection mode). **Rule 949110** is that threshold, not the cause: find the contributing rules for the same transaction ID in the WAF logs, then add a scoped **exclusion** (a request header, cookie, argument or body field) or a per-rule override. Typical false positives: sign-in forms with `'` or `--`, JSON bodies with HTML or SQL-like words. Don't turn the policy off or switch everything to Detection. ## Key Vault certificates on listeners | Error code | Cause → fix | |---|---| | `UserAssignedIdentityDoesNotHaveGetPermissionOnKeyVault` | The gateway's user-assigned identity needs **Key Vault Secrets User** (RBAC vault) or secret get (access policy vault) | | `KeyVaultHasRestrictedAccess` | The vault firewall blocks the gateway: allow trusted services, or use a private endpoint the gateway's VNet resolves | | `SecretDisabled` / `SecretDeletedFromKeyVault` / `KeyVaultSoftDeleted` | The secret or vault is disabled or deleted: re-enable, recover, or point at a new secret ID | | `UserAssignedManagedIdentityNotFound` | The identity was deleted: assign a new one with access | | `ApplicationGatewaySslCertificateDataMustBeSpecified` | A listener certificate has neither data nor a Key Vault secret ID | Use a **versionless** secret ID so renewals are picked up. Key Vault rules: `reference/keyvault/access-and-errors.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.