In your Azure Portal, select your web app running the site.

Go to the SSL Settings blade, and in the Private Certificates tab check whether you've got the xConnect client certificate installed there, and whether that thumbprint matches what you have in your config settings.
(If the certificate doesn't show here it needs to be uploaded first)

If that's the case, open the Advanced Tools (should have a link that opens in a new tab), where you can select Debug console -> PowerShell. In the PowerShell console, type

Get-ChildItem -path cert:\LocalMachine\My

See if your certificate appears there.

If that's not the case, go back to your web app, go to Application Settings and add the setting WEBSITE_LOAD_CERTIFICATES with the value of either the thumbprint or (if you have more certificates) the value *:

In your Azure Portal, select your web app running the site.

Go to the SSL Settings blade, and in the Private Certificates tab check whether you've got the xConnect client certificate installed there, and whether that thumbprint matches what you have in your config settings.
(If the certificate doesn't show here it needs to be uploaded first)

If that's the case, open the Advanced Tools (should have a link that opens in a new tab), where you can select Debug console -> PowerShell. In the PowerShell console, type

Get-ChildItem -path cert:\CurrentUser\My

See if your certificate appears there.

If that's not the case, go back to your web app, go to Application Settings and add the setting WEBSITE_LOAD_CERTIFICATES with the value of either the thumbprint or (if you have more certificates) the value *: