Azure Application Gateway HTTP Status 0 Responses

Context: You have a website running on Azure App Service that has a Azure Application Gateway in front.

Problem: Your clients receive the dreaded ERR_CONNECTION_CLOSED error randomly.

 

Troubleshooting: If you look at the Application Gateway logs, you will notice that the HttpStatus is 0. It is not a standard HTTP status code. You will also notice that SentBytes is also 0.

In such cases, the App Gateway does not forward the traffic to your backend target.

Cause: The predominant cause of such issues is that your application exceeded a certain Application Gateway limits as described in https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-application-gateway-limits . For example, you may have cookie data that exceeds the 16 KB limit for HTTP/2. You can check your cookie sizes in Developer tools as shown below.

 

 

Unfortunately, as of August 2025, the only way to know what limit you exceeded is by opening at ticket with Microsoft Support.  

Solution: Modify your application code or adjust the appropriate configuration values, if applicable. 

blog@aileronconsulting.com
 

Azure App Gateway with Certificate in Key Vault

It is common practice to utilize the Azure App Gateway for your web apps. SSL traffic would terminate at the gateway in this scenario. Wouldn't it be nice if you didn't have to worry about renewing your SSL certificate manually. You can do that by using the App Service Certificates and storing them in a Key Vault. The only problem is that as of the writing of this post (Feb 2024), the Azure Portal does not support App Gateway (Standard V2 tier) reading certificates from the Key Vault. According to this document https://learn.microsoft.com/en-us/azure/application-gateway/key-vault-certs#supported-certificates, this can only be accomplished via "non-portal resources like PowerShell, the Azure CLI, APIs, and Azure Resource Manager templates (ARM templates)".

 The alternative is to export the certificate and manually import the PFX file into the Key Vault. You will have to remember to do this when you renew the certificate.

Hopefully this feature will be added to the Azure Portal soon.

blog@aileronconsulting.com