"Successfully imported Key Vault Certificate, but failed to configure SSL binding"

Question

"Successfully imported Key Vault Certificate, but failed to configure SSL binding"

Lee Reams 0

I have a number of certificates in my Azure Key Vault, which were all generated the same way. I also have a number of Web App Services, which were all created the same way. But sometimes, when I add a custom domain to an App Service, and then try to bind a certificate from my Key Vault, I get an error that looks like:

Successfully imported Key Vault Certificate, but failed to configure SSL binding for foobar.example.com with ABCDEF0123456789ABCDEF0123456789 due to error: Certificate ABCDEF0123456789ABCDEF0123456789 was not found.

I'm really confused by this error. If it was successfully imported, then why was it not found? And why does this only happen to me every now and then? Most of the time these exact same steps work without issue.

Steve Morgan 0 Reputation points

2024-10-04T05:43:17.49+00:00

Just had the exact same issue. Turns out it has successfully imported and bound the certificate.

This stuff seems incredibly flakey and doesn't provide much confidence. Does anyone actually test this stuff?
Steve Morgan 0 Reputation points

2024-10-04T06:30:11.27+00:00

OK - it's a super rubbish error.

I think it's because the friendly name you have set for the certificate is conflicting. I added a suffix for my deployment slot and it imported straight away.

The Validation in the "Validate" needs updating to check for this and the error message needs improving MS.
SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2024-10-25T11:22:41.8933333+00:00

@Lee Reams Apologies for inconvenience here! I have reached out to you privately could you please respond.

1 answer

Your answer

Steve Morgan 0 Reputation points

2024-10-04T05:43:17.49+00:00

Just had the exact same issue. Turns out it has successfully imported and bound the certificate.

This stuff seems incredibly flakey and doesn't provide much confidence. Does anyone actually test this stuff?
Steve Morgan 0 Reputation points

2024-10-04T06:30:11.27+00:00

OK - it's a super rubbish error.

I think it's because the friendly name you have set for the certificate is conflicting. I added a suffix for my deployment slot and it imported straight away.

The Validation in the "Validate" needs updating to check for this and the error message needs improving MS.
SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2024-10-25T11:22:41.8933333+00:00

@Lee Reams Apologies for inconvenience here! I have reached out to you privately could you please respond.

Answer 1

Akhilesh Vallamkonda 15,320 Microsoft External Staff Moderator

Hi @Lee Reams

Thank you for post!

I understand that when you add a custom domain to an App Service, and then try to bind a certificate from my Key Vault, I get an error that looks like:

Successfully imported Key Vault Certificate, but failed to configure SSL binding for foobar.example.com with ABCDEF0123456789ABCDEF0123456789 due to error: Certificate ABCDEF0123456789ABCDEF0123456789 was not found.

Could you please try to configure SSL binding for domain by following below artical.
Provide security for a custom DNS name with a TLS/SSL binding in App Service
If the issue is not fixed Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control and Assign a Key Vault access policy to perform different operations on Key Vault secrets, keys, and certificates.
Hope this helps. Do let us know if you any further queries by responding in the comments section.

Thanks,

Akhilesh.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Lee Reams 0 Reputation points

2024-10-17T19:32:36.1766667+00:00

The steps in the article are already the steps I'm following. And I have over a dozen app services, each with their own domain and SSL cert, all generated and configured the same way. But only one of the app services failed to import a certificate from the key vault. You did not read my question.
Akhilesh Vallamkonda 15,320 Reputation points Microsoft External Staff Moderator

2024-10-17T20:07:24.6633333+00:00

Hi @Lee Reams
May I know which permission model you are using in the access configuration
Check if your Key Vault is set to use "Azure role-based access control" under "Access configuration". It needs to be set to "Vault access policy" instead.

By default, the App Service resource provider doesn't have access to your key vault. To use a key vault for a certificate deployment, you must authorize read access for the resource provider (App Service) to the key vault. You can grant access either with access policy or RBAC.
For more info, please read Authorize App Service to read from the vault
Lee Reams 0 Reputation points

2024-10-17T22:54:57.9333333+00:00

It was already set to "Vault access policy".

As previously stated, most of my app services have no trouble loading certs from this same key vault. Only occasionally have I run into this error, with no discernible cause or differentiating factor.

Share via

"Successfully imported Key Vault Certificate, but failed to configure SSL binding"

1 answer

Your answer