Our app serivce certificate that we have had for a year is up for renewal. When I went in the portal to check, it display denied, and all the options for manual renewal are missing. The timeline looks very weird with a bunch of unknowns. The instructions reference selecting options that don't exist in the portal. these don't make any sense as we have been using this certificate for a year now. There is no App service option in the portal ui. Any help would be appreciated.

Following-up from our offline support/discussion, to benefit the community. 1.Add GoDaddy to the list of allowed CAA's (Certification Authority Authorization) 2.Purchase a new certificate and replace the binds.(This step only applies if step 1 above fails) --Resolved after buying a new certificate and replacing the binds. Apologies for all the inconvenience Thanks for your patience and collaboration!

Certificate Renewal Denied

VPMars 6

Our app serivce certificate that we have had for a year is up for renewal. When I went in the portal to check, it display denied, and all the options for manual renewal are missing. User's image

The timeline looks very weird with a bunch of unknowns.
User's image

The instructions reference selecting options that don't exist in the portal. these don't make any sense as we have been using this certificate for a year now. There is no App service option in the portal ui. User's image

Any help would be appreciated.

ajkuma 24,971 Reputation points Microsoft Employee

2023-04-17T12:31:09.6766667+00:00

@VPMars , Firstly, apologies for the delay from over the weekend and for any inconvenience with this. As I understand from your issue description, your App Service certificate (ASC) automatic renew is showing up an error ( certificate denied). To better assist you on this, we may need additional info about your ASC.

--You may leverage diagnostics tool from Azure Portal> Navigate to your App Service Certificate in the Azure Portal.
--In the left navigation, click on Diagnose and solve problems – And run the Configuration tool to fetch more info about the error – “Auto-renewal”, Renewing-Rekeying” , etc.

As a side note, outlined in the doc - Starting September 23 2021, if you haven't verified the domain in the last 395 days, App Service certificates require domain verification during a renew or rekey process. The new certificate order remains in "pending issuance" mode during the renew or rekey process until you complete the domain verification.

Unlike an App Service managed certificate, domain re-verification for App Service certificates isn't automated. Failure to verify domain ownership results in failed renewals. For more information about how to verify your App Service certificate, review Confirm domain ownership section. Also, the renewal process requires that the well-known service principal for App Service has the required permissions on your key vault. These permissions are set up for you when you import an App Service certificate through the Azure portal. Kindly ensure that you have these permissions from your key vault intact.

Kindly let us know how it goes, I'll follow-up with you further.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
VPMars 6 Reputation points

2023-04-17T12:41:29.69+00:00

Thanks for your reply ajkuma. The funny thing is that thy certificate is showing as verified, but it's still stuck with all the options to renew or continue disabled. This certificate is in use with multiple app services in our subscription.
ajkuma 24,971 Reputation points Microsoft Employee

2023-04-17T12:54:12.9133333+00:00

Thanks for the follow-up and update. If feasible, could you please share your ASC and Azure WebApp names to check some internal logs.
VPMars 6 Reputation points

2023-04-17T12:59:02.71+00:00

Example App service : marsworx-poc.azurewebsites.net Subscription Name is : PrincipleWorx
ajkuma 24,971 Reputation points Microsoft Employee

2023-04-17T19:08:45.1266667+00:00
Thanks for follow-up and sharing the site details. After initial check, for a focused assistance, I wish to engage with you offline for a deeper investigation, please send an email with subject line “Attn:Ajay” to AzCommunity[at]Microsoft[dot]com and the following details, I will follow-up with you. Reference this Q&A thread

Your Certificate Name

Time of occurrence in UTC

Thanks for your patience and cooperation!

Note: Please do not share any PII data on the public forum.

1 answer

ajkuma 24,971 Reputation points Microsoft Employee

2023-04-28T05:06:08.6733333+00:00

Following-up from our offline support/discussion, to benefit the community.

1.Add GoDaddy to the list of allowed CAA's (Certification Authority Authorization)

2.Purchase a new certificate and replace the binds.(This step only applies if step 1 above fails)

--Resolved after buying a new certificate and replacing the binds.

Apologies for all the inconvenience Thanks for your patience and collaboration!
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

Certificate Renewal Denied

1 answer