AFD managed certificate not propagating to edge nodes after subscription reinstatement

Question

AFD managed certificate not propagating to edge nodes after subscription reinstatement

Mike Meyers 30

Hey,

We are experiencing an issue with Azure and our Front Door settings. Our monthly payment was delayed, which caused about an hour of downtime for all our services. That issue has been resolved, so everything is working on that front.

However, our images are not being loaded in the frontend anymore. Everything looks fine in Azure itself, but when we try to fetch the images, we get the following error:

URL: https://media.orfit.com/strapi-uploads/media/logo_f682c5e347.svg
Response: net::ERR_CERT_COMMON_NAME_INVALID

This was working before the downtime, and now we are seeing this error. Could you fix this on your side, or advise us on the best way to resolve it?

Thanx in advance.
With kind regards,
Mike Meyers

Screenshot 2026-03-26 at 17.41.38

Mike Meyers 30 Reputation points

2026-03-26T18:50:32.6966667+00:00

Hey,

Thanx for the fast response. I have run "nslookup media.orfit.com" and it says it can find the right endpoint association as you can see. So these settings should be right if I am not mistaken. I updated aswell the domain for a refresh. I can update the route aswell but all settings in here are looking good. So this should be already correct, unless you say for updating that aswell. I will wait for an hour as you suggest. The settings in the Front door are looking good aswell. Everything says "Provision succeeded" or "Enabled" in here too.

Non-authoritative answer:

media.orfit.com canonical name = orfitmedia-ax....z01.azurefd.net.

orfitmedia-ax....z01.azurefd.net canonical name = mr-z01.tm-azurefd.net.

Name: mr-z01.tm-azurefd.net
Mike Meyers 30 Reputation points

2026-03-27T13:18:11.59+00:00

Hey,

Could you provide more help on this?

After subscription reinstatement following payment suspension, and after fully deleting and recreating the Front Door manager configuration, edge nodes still serve CN=*.azureedge.net instead of the AFD managed certificate for media.orfit.com. Portal shows domain as Succeeded/Approved with certificate Deployed (145 days to expiry). This has been ongoing for 24+ hours with full production impact. openssl confirms wrong cert on all edge nodes.
We already have this version of the Front door: Azure Front Door Standard/Premium. We deleted the current one and added it again but still the same result at the moment.
Vallepu Venkateswarlu 10,590 Reputation points Microsoft External Staff Moderator

2026-03-27T14:40:12.93+00:00

Hi @Mike Meyers,

This is to inform you that the AFD certificate update may take up to 72 hours to fully propagate. Please wait for this duration and then check the result.

Refer: https://learn.microsoft.com/en-us/azure/frontdoor/domain?pivot=front-door-standard-premium#rotate-own-certificate

Please "upvote" if the information helped you. This will help us and others in the community as well.
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-03-30T03:55:17.2333333+00:00

Hi Mike Meyers,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.
Mike Meyers 30 Reputation points

2026-03-31T10:06:14.4066667+00:00

Hey,

The issue is fixed and your information was helpfull indeed.
But I got another question, why does it takes 72 hours for the new certificate to be automatically deployed?
This takes way to long in my perspective, so what is the reason behind that?

With kind regards,

Mike Meyers
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-04-01T05:39:51.0933333+00:00

Hi Mike Meyers,

Posted and updated in answer.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer accepted by question author

0 additional answers

Your answer

Mike Meyers 30 Reputation points

2026-03-26T18:50:32.6966667+00:00

Hey,

Thanx for the fast response. I have run "nslookup media.orfit.com" and it says it can find the right endpoint association as you can see. So these settings should be right if I am not mistaken. I updated aswell the domain for a refresh. I can update the route aswell but all settings in here are looking good. So this should be already correct, unless you say for updating that aswell. I will wait for an hour as you suggest. The settings in the Front door are looking good aswell. Everything says "Provision succeeded" or "Enabled" in here too.

Non-authoritative answer:

media.orfit.com canonical name = orfitmedia-ax....z01.azurefd.net.

orfitmedia-ax....z01.azurefd.net canonical name = mr-z01.tm-azurefd.net.

Name: mr-z01.tm-azurefd.net
Mike Meyers 30 Reputation points

2026-03-27T13:18:11.59+00:00

Hey,

Could you provide more help on this?

After subscription reinstatement following payment suspension, and after fully deleting and recreating the Front Door manager configuration, edge nodes still serve CN=*.azureedge.net instead of the AFD managed certificate for media.orfit.com. Portal shows domain as Succeeded/Approved with certificate Deployed (145 days to expiry). This has been ongoing for 24+ hours with full production impact. openssl confirms wrong cert on all edge nodes.
We already have this version of the Front door: Azure Front Door Standard/Premium. We deleted the current one and added it again but still the same result at the moment.
Vallepu Venkateswarlu 10,590 Reputation points Microsoft External Staff Moderator

2026-03-27T14:40:12.93+00:00

Hi @Mike Meyers,

This is to inform you that the AFD certificate update may take up to 72 hours to fully propagate. Please wait for this duration and then check the result.

Refer: https://learn.microsoft.com/en-us/azure/frontdoor/domain?pivot=front-door-standard-premium#rotate-own-certificate

Please "upvote" if the information helped you. This will help us and others in the community as well.
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-03-30T03:55:17.2333333+00:00

Hi Mike Meyers,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up-vote” if the information helped you. This will help us and others in the community as well.
Mike Meyers 30 Reputation points

2026-03-31T10:06:14.4066667+00:00

Hey,

The issue is fixed and your information was helpfull indeed.
But I got another question, why does it takes 72 hours for the new certificate to be automatically deployed?
This takes way to long in my perspective, so what is the reason behind that?

With kind regards,

Mike Meyers
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator

2026-04-01T05:39:51.0933333+00:00

Hi Mike Meyers,

Posted and updated in answer.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 1

Hi Mike Meyers,

It looks like your custom domain’s managed cert didn’t make it out to the edge after the subscription came back online so browsers are still seeing the default “*.azurefd.net” cert (hence the CN mismatch). Here’s how you can troubleshoot and get HTTPS back up:

Verify your DNS • Run nslookup media.orfit.com (or use an online DNS checker) to ensure the CNAME is pointing exactly at your Front Door endpoint (e.g. yourfrontdoorname.azurefd.net). • If the CNAME is missing or pointing elsewhere, the managed cert won’t issue/apply.
Check the custom-domain + cert status in the portal • In Azure Portal go to your Front Door (Classic) → Frontend/domains → select media.orfit.com. • Under “Certificate management type” you should see Enabled and a valid expiry date. – If it’s Not enabled, Pending, or shows Custom domain unavailable, click Edit, reselect Azure Front Door managed certificate, then save. • Keep in mind it can take ~60 minutes for a Classic-SKU cert change to propagate to all edge POPs.
Wait for propagation or force a re-issue • After you re-enable the managed cert, wait up to an hour and retest. • If it’s still serving the wrong cert after an hour, toggle to “Bring your own certificate” (BYOC) as a workaround, then back to “Azure-managed” to force a fresh DCV and cert rollout.
Consider BYOC or SKU migration • If you need a faster turnaround or more control, upload your own TLS cert into Key Vault and configure BYOC on that custom domain. • Looking ahead, Classic SKUs will lose Azure-managed cert support after 15 August 2025—so you may want to plan a migration to Front Door Standard/Premium or BYOC before then.
This is to inform you that the AFD certificate update may take up to 72 hours to fully propagate. Please wait for this duration and then check the result.

Update:

But I got another question, why does it takes 72 hours for the new certificate to be automatically deployed? This takes way to long in my perspective, so what is the reason behind that?

Glad it’s fixed. Here’s the simple truth: the 72 hours isn’t about the certificate it’s about the internet’s memory.

Front Door runs on hundreds of servers worldwide. When the cert changes, Azure has to update every single one, slowly and safely, so no one gets stuck with a broken connection. At the same time, browsers, ISPs, and company firewalls all “remember” the old certificate for up to a few days. Azure waits for all those old memories to fade before they can promise everyone sees the new one.

So, 72 hours is just a worst-case safety buffer. Most of the time it’s done in under an hour. But after a payment suspension or a full recreate, you hit the slow, careful path.

References

Configure HTTPS on a Front Door (classic) custom domain https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https
Domains in Azure Front Door: HTTPS for custom domains https://learn.microsoft.com/azure/frontdoor/domain#https-for-custom-domains

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.