Q:

Configuring SSL certificate off-load when dealing with Azure web app behind Application Gateway

I have set up an application gateway(AG) to eventually protect my web app using this link but with the difference that the AG's public IP will forward the requests to my web app and I won't be using any jump box. 
This diagram should give you a better idea.
Now on my web app, I have added couple of domains under the Custom domains and I don't have any SSL binding thinking that the AG will do the work. Basically I have added the SSL cert to the AG's Front End IP--->Listener. I also redirect the HTTP to HTTPs on AG using the listeners, and on the web app I am not forcing HTTPS.
My questions are:

Is this roughly the right way to protect a web app (Please note that in the future I intend to enable WAF and the DDOS protection on AG)?
Is having the AG do the encryption/decryption going to slow things down?

EDIT: I actually removed the two domains from the web app's custom domains and it seems to work fine without it but I still have the above two questions. :)

A:

Yes, this is the way of doing it, if you want to can configure end-to-end ssl (a bit more secure)  
Obviously it will, but negligible.

