Azure Web App通过HTTPS连接Azure SQL DB时出现504网关超时错误
Let’s walk through this issue systematically—since your local dev environment connects to the Azure SQL DB just fine over both HTTP and HTTPS, the problem is almost certainly rooted in how your Azure cloud setup (Web App + CDN) is handling traffic or communicating with the backend. Here’s what to check step by step:
1. Tweak CDN Timeout & Cache Settings First
504 errors from CDNs usually mean the CDN waited too long for your Web App to respond. For Azure Verizon Standard CDN:
- Adjust Origin Request Timeout: Head to your CDN endpoint’s settings, look for Origin Request Timeout (under Origin Settings). The default might be too short (often 60 seconds), but your connection string uses a 300-second timeout. Match this value to ensure the CDN doesn’t cut off the request before your app can talk to SQL.
- Bypass Cache for Dynamic Login Path: Login pages are dynamic and shouldn’t be cached. Create a CDN rule (via Rules Engine) targeting the path
/myMagicStringBlogAccount/Loginand set the cache behavior to Bypass cache. Cached error responses can persist and cause false positives, so this is critical.
2. Verify CDN ↔ Web App HTTPS Communication
Even if your local HTTPS works, the CDN and Web App might have misaligned SSL settings:
- Confirm Origin Configuration: Ensure your CDN’s origin is set to your Web App’s HTTPS endpoint (e.g.,
yourapp.azurewebsites.net) and that you’re using TLS 1.2+ as the protocol. Avoid using HTTP for the origin if your Web App enforces HTTPS. - Check SSL Certificate Validation: Verizon CDN can fail to connect if it can’t verify your Web App’s SSL certificate. If you’re using a custom domain on the Web App, make sure the certificate is properly installed and trusted by Verizon’s root CA bundle. You can temporarily disable SSL validation for the origin (for testing only) to rule this out.
3. Double-Check Azure SQL Firewall & Web App Outbound IPs
You mentioned the firewall allows the app server IP, but Azure Web Apps have multiple outbound IPs—all of them need access to SQL:
- Grab All Outbound IPs: In the Azure Portal, go to your Web App → Properties and copy all listed Outbound IP Addresses. Add every single one to your Azure SQL DB’s firewall rules.
- Temporary SSL Cert Test: To rule out SSL issues between Web App and SQL, temporarily set
TrustServerCertificate=Truein your connection string (don’t leave this long-term for security!). If the error goes away, your Web App is missing the root CA certificate needed to verify Azure SQL’s SSL cert—ensure your App Service plan uses the latest root certificate bundle.
4. Diagnose Web App Directly (Bypass CDN)
To isolate whether the problem is the CDN or the Web App itself:
- Access Web App Natively: Visit your Web App’s native HTTPS URL (e.g.,
https://yourapp.azurewebsites.net/myMagicStringBlogAccount/Login). If this also returns a 504, the issue is with the Web App or SQL connection in Azure:- Enable detailed logging: Turn on Application Logging (File System) and HTTP Logging under App Service Logs. Check the logs for SQL connection timeouts or internal server errors that might be causing delays.
- Check resource usage: Use Azure Monitor to look at CPU, memory, and request queue length. If your app is resource-starved, it might not respond in time to the CDN’s request.
- If Direct Access Works: The problem is definitely in your CDN configuration. Revisit the timeout and cache rules, and check for any Rules Engine rules that might be modifying or blocking the login request (e.g., incorrect URL rewrites or header manipulations).
5. Validate DNS & CDN Propagation
Make sure your custom domain’s DNS records are correctly pointing to the CDN endpoint, and that propagation is complete. Use nslookup or similar tools to confirm the domain resolves to the CDN’s IP, not the old Web App IP. Stale DNS can cause traffic to be routed incorrectly.
内容的提问来源于stack exchange，提问作者Darshan Shah
