Lets encrypt issues free shortlived SSL certs - you can set up azure to renew them automatically:

https://www.hanselman.com/blog/SecuringAnAzureAppServiceWebsiteUnderSSLInMinutesWithLetsEncrypt.aspx

Lets encrypt

1. Add custom domain

2. Azure AD , App reg:  xxxxLetsEncrypt

remember AppId: xxxxxxxx

add secret - name it login  yyyyyyyy

3. Resource group running xxx, AccessControl, add permission, contributor , your app xxxLetsEncrypt should be contributor

4. go to the app service in azure portal xxx, Extensions, Azure Lets Encrypt, you must add connection strings in setting

AzureWebJobsDashboard

AzureWebJobsStorage  , both with the same valeu: connection string to your storage account

5. configure extension  http://YOURSITENAME.scm.azurewebsites.net/LetsEncrypt

...follow the guide/next - you get a box with your domain names, select one +request and install, repeat, ->  you now have certs

6 go back to app and use them on your custom domains, turn on always SSL