Lets encrypt issues free shortlived SSL certs - you can set up azure to renew them automatically:

https://www.hanselman.com/blog/SecuringAnAzureAppServiceWebsiteUnderSSLInMinutesWithLetsEncrypt.aspx

Lets encrypt

1. Add custom domain to your App
2. Add or reuse a storage account and copy the connectionstring for use in step 6 (the lets encrypt extension store data here)
3. Azure AD , App reg:  xxxxLetsEncrypt
   1. remember AppId: xxxxxxxx
4. add secret - name it login  yyyyyyyy
5. Resource group running xxx, AccessControl, add permission, contributor , your app xxxLetsEncrypt should be contributor
6. go to the app service in azure portal xxx, Extensions, Azure Lets Encrypt, you must add connection strings in setting
   1. AzureWebJobsDashboard
   2. AzureWebJobsStorage  , both with the same valeu: connection string to your storage account
7. configure extension  http://YOURSITENAME.scm.azurewebsites.net/LetsEncrypt
   1. ...follow the guide/next - you get a box with your domain names, select one +request and install, repeat, ->  you now have certs
8. go back to app and use them on your custom domains, turn on always SSL