How to create a root certificate for application gateway?

I have a webapp hosted in Azure app service and has a certificate associated with its domain and the certificate is stored in the keyvault.
I want to create one application gateway with web application firewall(WAF v2 tier). In that application gateway, I need to use one certificate in the backend setting.
I tried to use the same certificate which is present is the keyvault here, but I am getting the error of "ApplicationGatewayTrustedRootCertificateInvalidData".

So which root certificate should I use in the application gateway and use it in app service too?
I tried to create one self signed root certificate but due to this the health of backend servers are coming as unhealthy with the error message -

The Common Name (CN) of the backend server certificate does not match the host header entered in the health probe configuration (v2 SKU) or the FQDN in the backend pool (v1 SKU). Verify if the hostname matches with the CN of the backend server certificate. To learn more visit - https://aka.ms/backendcertcnmismatch.

I tried to reproduce the same in my environment I got the same error:

Application Gateway verify that the host name listed in the backend HTTP settings corresponds to the CN displayed by the backend server's TLS/SSL certificate.

If you receive this error message, HTTP settings if Pick hostname from backend HTTP settings is selected. If you're using a default probe, 127.0.0.1 will be entered as the host name. Try to create a custom probe and link it to the HTTP settings if that is not the required value.

Backend health of the application Gateway it works with the custom CA root certificate uploaded in the HTTP settings. Only backend certificates that are signed by a known trustworthy root certificate are compatible with health probes. Try removing well known CA root certificate from the HTTP settings on the Gateway and I am able to add a probe without the root certificate.

As per lovelinuxalot, In this github try to Add the probes without testing health check and Make sure Health probes recognize the trusted root certificates uploaded on the gateway HTTP settings

Click win+R -> type certlm.msc and select Enter. -> click on personal -> certificates.

Double click on certificates -> details tab -> subject Check the certificate's CN from its details and enter it in the custom probe's host name field or in the HTTP settings (if Pick hostname from backend HTTP settings is selected). If that's not desired host name for your website, you need to either obtain a certificate for that domain or provide the proper host name in the settings of the custom probe or HTTP option. Refer this.

Try to check the intermediate certs on the backend cert of online tool for checking SSL certificates.

References:

CN of backend server certificate does not match the host header in health probe configuration

AppGateway V2 Certificate issue by GitaraniSharma