How to create managed certificate for apex domains?

Ernesto 61

When I tried to use portal.azure.com to create managed certificates, it fails.

SnehaAgrawal-MSFT 22,166 Reputation points

2023-07-13T12:29:44.6733333+00:00

@Ernesto Just checking if you have chance to see recent response.

Please let us know if further query or issue remains.

Please accept as "Yes" if the answer provided is useful , so that you can help others in the community looking for remediation for similar issues.

1 answer

SnehaAgrawal-MSFT 22,166 Reputation points

2023-07-11T12:48:11.7633333+00:00
@Ernesto Thanks for reaching here! If I have understood correctly, you want to create App Service managed certificate for apex domains. Could you elaborate on what error message you are receiving..

Also, as its mentioned in the blog by Yutang that-

App Service Managed Certificates for apex domains are validated with HTTP token validation which App Service will set up on your behalf. However, to ensure a successful create and renewal validation, you want to make sure that you have the following set up, otherwise your certificate validation will fail.

Add an apex domain to your web app by mapping an A record and TXT record to your web app.

Your web app must be accessible from the public network and does not have any IP restrictions set up. You cannot validate your certificate if your web app is not accessible from the public network. Adding IP restrictions after creating a certificate will cause renewal to fail.

Please refer to this blog for more details, App Service Managed Certificate (Preview) Now Supports Apex Domains

Please let us know if further query or issue remains.
Please sign in to rate this answer.
Ernesto 61 Reputation points

2023-07-11T13:04:29.0133333+00:00

I have received this error

Error adding managed certificate: Properties.CanonicalName is invalid. Not found CNAME directly pointing to *.azurewebsites.net. Current CNAME record of the hostname alyeska.xom.cloud is empty.

SnehaAgrawal-MSFT 22,166 Reputation points

2023-07-12T06:38:47.66+00:00

@Ernesto Thanks for reply!

Error received is-

Properties.CanonicalName is invalid. Not found CNAME directly pointing to *.azurewebsites.net. Current CNAME record of the hostname alyeska.xom.cloud is empty.

It seems you have created child public DNS zone for creating the root domain of the format example - [xxxxx.yyyyyy.com]

The portal treats it as subdomain and does subdomain CNAME based validation to issue the managed (ASMC) certificate. This is a known issue currently. If you don't have the required CNAME based DNS record, then the ASMC creation will fail with the above error.

Workarounds:

Use REST API to enforce http-token based validation.

or

Have CNAME DNS record instead of A record, then managed certificate purchase should be possible through the portal. see- https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain?tabs=subdomain%2Cazurecli#with-a-cname-record

Please let us know if further query or issue remains.

Ernesto 61 Reputation points

2023-07-13T12:51:03.2766667+00:00

Hi, when I try to add CNAME record, I receive this warning

No matching CNAME Record was found. You may still add the custom domain to your web app, but your web app will not receive any traffic until the correct CNAME Record is created

Ernesto 61 Reputation points

2023-07-13T12:52:33.8766667+00:00

and when I try to create binding, I see same error

Properties.CanonicalName is invalid. Not found CNAME directly pointing to *.azurewebsites.net. Current CNAME record of the hostname alyeska.xom.cloud is empty.

SnehaAgrawal-MSFT 22,166 Reputation points

2023-07-14T12:28:21.1533333+00:00

@Ernesto Could you please reach out to us by sending an email with subject line “Attn:Sneha |thread title” to AzCommunity[at]microsoft[dot]com referencing this thread, would take closer look on this. Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to create managed certificate for apex domains?

1 answer

Your answer