Lets encrypt issues free shortlived SSL certs - you can set up azure to renew them automatically:
https://www.hanselman.com/blog/SecuringAnAzureAppServiceWebsiteUnderSSLInMinutesWithLetsEncrypt.aspx
Lets encrypt
1. Add custom domain
2. Azure AD , App reg: xxxxLetsEncrypt
remember AppId: xxxxxxxx
add secret - name it login yyyyyyyy
3. Resource group running xxx, AccessControl, add permission, contributor , your app xxxLetsEncrypt should be contributor
4. go to the app service in azure portal xxx, Extensions, Azure Lets Encrypt, you must add connection strings in setting
AzureWebJobsDashboard
AzureWebJobsStorage , both with the same valeu: connection string to your storage account
5. configure extension http://YOURSITENAME.scm.azurewebsites.net/LetsEncrypt
...follow the guide/next - you get a box with your domain names, select one +request and install, repeat, -> you now have certs
6 go back to app and use them on your custom domains, turn on always SSL