Add custom domain with CNAME record having public endpoint

Muhammad Usman Naeem Thanks for posting your question in Microsoft Q&A. When Azure Spring Apps service is deployed in VNET, applications are accessible only within the private network (via private endpoint). However, the apps can be exposed to Internet via

1. Application Gateway with two options: Expose applications to the internet with TLS Termination at Application Gateway & Expose applications with end-to-end TLS in a virtual network.
2. Standard public IP https://video2.skills-academy.com/en-us/azure/spring-apps/how-to-access-app-from-internet-virtual-network?tabs=azure-portal.

Since you are looking to add a custom domain, I suggest you follow application gateway route and step-by-step guide is described in option 3: Implement an application gateway with a custom domain.

Solution from doc:

To begin the setup process, ensure that you have properly prepared your self-signed certificate by including the root, intermediate and client certificates in the certificate chain with the same hostname as your custom domain. You can refer to the following link for more details: https://video2.skills-academy.com/EN-US/azure/spring-apps/tutorial-custom-domain?tabs=Azure-portal#prepare...

1. Merge the root certificate, middle certificate, and client certificate into a PFX file.
2. Import the PFX file certificate into Azure Key Vault.
3. Grant Azure Spring Apps access to your Key Vault.
4. Import the certificate from Azure Key Vault to your Spring app.
5. Add a custom domain to your Spring app.
6. Go to your DNS provider and add a CNAME record to map your domain to <service-name>-<appname>.private.azuremicroservices.io. If this is a custom domain created for testing purposes, you can add the CNAME record in Azure Private DNS zone.
7. Add an SSL binding to your Spring app.

After the operation is complete, you will be able to access your Spring app using a custom domain from the Virtual Network (VNet).

Then the same configuration needs to be applied to the Application Gateway. It is important to note that if you are using a self-signed certificate in the backend settings of your Application Gateway, you will need to select "No" for "Use well-known CA certificate" and upload the root certificate(.cer) that was merged into the PFX file in the previous step, under "Trusted root certificate".

In the "Host name" section, make sure to select "Override with specific domain name" and ensure that the hostname matches the one specified in the SSL certificate.

In the "Listeners" settings, add a new listener on port 443 and select the existing certificate with the merged certificate.

For testing purposes, edit your Windows host file and add a record to map the custom domain with the Application Gateway's public IP address. Or if you owned this domain, you could add a A record on domain provider to point to Application Gateway's public IP to make it work.

I hope this helps with your question and let me know if you have any other questions.

If you found the answer to your question helpful, please take a moment to mark it as Yes for others to benefit from your experience. Or simply add a comment tagging me and would be happy to answer your questions.