Hi
You can map a custom domain with the free certificate already. (https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate#create-a-free-certificate-preview)
I think you maybe just miss the option when you manage the custom DNS CNAME, as in that window the custom CNAME would be listed as unsecure. You add the correct SSL binding from there.