Lets encrypt issues free, shortlived SSL certs. You can set up Azure to renew them automatically:

https://www.hanselman.com/blog/SecuringAnAzureAppServiceWebsiteUnderSSLInMinutesWithLetsEncrypt.aspx

Lets encrypt:

1. Add a custom domain to your App
2. Add or reuse a storage account and copy the connectionstring for use in step 6 (the Lets encrypt extension stores data here)
3. Azure AD , App reg:  xxxxLetsEncrypt
   1. Remember AppId: xxxxxxxx
4. Add secret - name it login  yyyyyyyy
5. Resource group running xxx, AccessControl, add permission, contributor, your app xxxLetsEncrypt should be a contributor
6. Go to the app service in Azure portal xxx, Extensions, Azure Lets Encrypt, you must add connection strings in setting
   1. AzureWebJobsDashboard
   2. AzureWebJobsStorage, both with the same value: connection string to your storage account
7. Configure extension  http://YOURSITENAME.scm.azurewebsites.net/LetsEncrypt
   1. ...follow the guide/next - you get a box with your domain names, select one +request and install, repeat, ->  you now have certs
8. Go back to the app and use them on your custom domains, turn on always SSL.