Let's Encrypt issues free, short-lived SSL certs. You can set up Azure to renew them automatically:

https://www.hanselman.com/blog/SecuringAnAzureAppServiceWebsiteUnderSSLInMinutesWithLetsEncrypt.aspx

Let's Encrypt:

1. Add a custom domain to your App
2. Add or reuse a storage account and copy the connection string for use in step 6 (the Let's Encrypt extension stores data here)
3. Azure AD, App reg:  xxxxLetsEncrypt
   1. Remember AppId: xxxxxxxx
4. Add secret - name it login  yyyyyyyy
5. In the resource group running xxx, under AccessControl, add the contributor permission; your app xxxLetsEncrypt should be a contributor
6. Go to the app service in Azure portal xxx, select Extensions and Azure Let's Encrypt, and add connection strings in settings.
   1. AzureWebJobsDashboard
   2. AzureWebJobsStorage and AzureWebJobsDashboard, both with the same value: the connection string to your storage account
7. Configure extension  http://YOURSITENAME.scm.azurewebsites.net/LetsEncrypt
   1. ...Follow the guide/next; you get a box with your domain names. Select one, +request and install, and repeat; you now have certs.
8. Go back to the app, use them on your custom domains, and turn on always SSL.