securing the AFD, APIM and Function App

Hello,

I am currently exploring the best way to apply certificates to our infrastructure. We are using Azure Front Door, an API Management Service (APIM), and a Function App as the backend for API methods. One of the challenges I’m facing is how to implement a two-layer SSL termination: the first from the open internet to Front Door, and the second from the Front Door endpoint to the backend APIM.

I'm a bit confused about how to set up the DNS and certificates in this scenario.

Current Setup:

• Example domain: api.contoso.com
• DNS records:
  • CNAME pointing to the Azure Front Door (AFD) endpoint.
    • TXT record pointing to the Function App.
• Certificates:
  • AFD custom domain certificate.
  • App Service (Function App) certificate.

Architecture:

Azure Front Door → API Management (with CORS using an exclusive AFD custom domain and AFD endpoint; possibly adding a check-header policy) → Function App (restricted to only accept requests from APIM’s public IP).

Questions:

1. Do we still need to apply a custom certificate to the Function App, given that it is not accessible from the open internet and only communicates internally with APIM?
2. Given that APIM and the Function App already have valid Azure-provided HTTPS vanity URLs with certificates, is it worth creating and applying custom certificates for both APIM and the Function App?