application gateway health probe test fails but backend health status is healthy

Question

application gateway health probe test fails but backend health status is healthy

Srinu P 0

We have waf v2 azure app gateway with public and private listener. I have two fqdns in backend pool with server common name in its internal pki certificate. Azure listener url is different which is front end url. Health check probe config has pick hostname from backend.

Health Probe Test :

The Common Name (CN) of the backend server certificate does not match the host header entered in the health probe configuration (v2 SKU) or the FQDN in the backend pool (v1 SKU). Verify if the hostname matches with the CN of the backend server certificate.

But

Backend Health monitoring showing as Healthy.

is it bug ?

Jeevan Shanigarapu 2,615 Reputation points Microsoft External Staff Moderator

2025-10-30T04:45:18.1166667+00:00

Hello @Srinu P,

Welcome to Microsoft Q&A Platform. Thank you for reaching out.

I understand your question about the health probe warning on your WAF v2 Application Gateway.

The warning about the backend server certificate’s Common Name (CN) not matching the host header is expected and does not indicate a bug. The Application Gateway still considers the backend healthy if the SSL handshake is successful and HTTP responses are valid, even if the CN does not match exactly. This is because the gateway checks whether the health probe’s Host header matches the CN or Subject Alternative Name (SAN) on the backend certificate.

If there is a mismatch, you will see this warning. But if your certificate includes the hostname in the SAN, or if you have enabled "Pick hostname from backend," and all other checks pass, the backend will show as healthy.

No action is needed if the backend health is green and SSL connections work fine. It’s best practice that your backend certificate includes the relevant FQDN in the SAN and that probe hostname settings are correct. You can safely ignore this warning if everything else is working well.

Please feel free to reach out if you need any further assistance.

For more info: https://free.blessedness.top/en-us/azure/application-gateway/application-gateway-probe-overview
Srinu P 0 Reputation points

2025-10-30T11:09:39.4566667+00:00

Hi Jeevan, thanks for responding. Do we have any article that describes a manual test on health probe fails can be ignored when the backend health status shows healthy.
Jeevan Shanigarapu 2,615 Reputation points Microsoft External Staff Moderator

2025-10-31T12:57:41.5033333+00:00

Hello @Srinu P,
Thank you for your follow-up question.

At this time, there isn’t a specific Microsoft article that clearly states, “manual health probe test failures can be ignored if backend health shows healthy.” However, the behavior you’re seeing is by design and documented in the health probe overview.
https://free.blessedness.top/en-us/azure/application-gateway/ssl-overview#for-probe-traffic

Regard's
Jeevan S

Your answer

Jeevan Shanigarapu 2,615 Reputation points Microsoft External Staff Moderator

2025-10-30T04:45:18.1166667+00:00

Hello @Srinu P,

Welcome to Microsoft Q&A Platform. Thank you for reaching out.

I understand your question about the health probe warning on your WAF v2 Application Gateway.

The warning about the backend server certificate’s Common Name (CN) not matching the host header is expected and does not indicate a bug. The Application Gateway still considers the backend healthy if the SSL handshake is successful and HTTP responses are valid, even if the CN does not match exactly. This is because the gateway checks whether the health probe’s Host header matches the CN or Subject Alternative Name (SAN) on the backend certificate.

If there is a mismatch, you will see this warning. But if your certificate includes the hostname in the SAN, or if you have enabled "Pick hostname from backend," and all other checks pass, the backend will show as healthy.

No action is needed if the backend health is green and SSL connections work fine. It’s best practice that your backend certificate includes the relevant FQDN in the SAN and that probe hostname settings are correct. You can safely ignore this warning if everything else is working well.

Please feel free to reach out if you need any further assistance.

For more info: https://free.blessedness.top/en-us/azure/application-gateway/application-gateway-probe-overview
Srinu P 0 Reputation points

2025-10-30T11:09:39.4566667+00:00

Hi Jeevan, thanks for responding. Do we have any article that describes a manual test on health probe fails can be ignored when the backend health status shows healthy.
Jeevan Shanigarapu 2,615 Reputation points Microsoft External Staff Moderator

2025-10-31T12:57:41.5033333+00:00

Hello @Srinu P,
Thank you for your follow-up question.

At this time, there isn’t a specific Microsoft article that clearly states, “manual health probe test failures can be ignored if backend health shows healthy.” However, the behavior you’re seeing is by design and documented in the health probe overview.
https://free.blessedness.top/en-us/azure/application-gateway/ssl-overview#for-probe-traffic

Regard's
Jeevan S

Share via

application gateway health probe test fails but backend health status is healthy

Your answer