You can chose to use a free managed certificate for your web app from Azure Portal:
In Azure Portal go to TLS/SSL settings blade of your webapp.
Choose Private Key Certificates on the top
Click on + Create App Service Managed Certificate
In the popup select the sub-domain you want to choose
Wait… and the sub-domain will be verified and will be get green:
Hit on Create button and wait until it is finished.
Go to Custom domains blade in your App service.
Notice that the newly created certificates are part of the custom domains.
Hit on Add binding on the sub-domain you want to associate.
In the popup select the certificate and SSL Type. Then hit Add button.
