Error when trying to add an App Service Managed Certificate

V1xIII 0

I'm trying to add an App Service Managed Certificate to my site, and it keeps failing after hours of trying to complete. I've tried from the certificates page, as well as from the custom domains page in the "add binding" menu. The status on my custom domain says "no binding" at the moment.

I have added the CAA record to my Cloudflare DNS records (0 issue digicert.com).

My plan is currently Basic (B1), location is South Central US.

I have no other certificates currently.

Error details:

Operation name - Add or Update Certificate
Error code - ResourceOperationFailure
Message - The resource operation completed with terminal provisioning state 'Failed'.

I'm sure I'm missing something simple, pretty new at this side of things.

ajkuma 27,591 Reputation points Microsoft Employee

2024-02-22T13:53:52.2+00:00

@V1xIII , Just to clarify, is this issue confined only to South Central US?

If you haven't done, you may leverage App Service diagnostics from Azure Portal> Navigate to your App Service app in the Azure Portal.

In the left navigation, click on Diagnose and solve problems - Review - "SSL and Domains" and “Configuration and Management” options.

If your requirement fits, you may try deploying certificate in another proximity region or re-try the operation and let us know.
V1xIII 0 Reputation points

2024-02-22T20:03:24.2266667+00:00

I don't see anything on the pages you suggested that indicates why I can't create a managed certificate. I attempted to move my app service to another US region, but it seems that South Central US is the only region I can deploy on (I tried most of the others). "1 resource(s) have been removed from your original selection as they cannot move to the destination". I am currently in the 30 day free trial, if that makes a difference.
ajkuma 27,591 Reputation points Microsoft Employee

2024-02-25T16:50:05.4466667+00:00

Thanks for the follow-up and additional info.

There are a few conditions for moving an - Move an App Service resource to another region (checkout the doc guidance). Also, see App Service limits.
Since you are able to provision the resource (managed certificate) on other regions, you may leverage the same. I'll also relay this feedback internally to our product team.
V1xIII 0 Reputation points

2024-03-05T15:07:50.04+00:00

I have not yet found a solution. It looks like I'll have to handle my certificates manually. I am not able to move my app to any of the other regions I've attempted, and I am still unable to create a managed certificate.
ajkuma 27,591 Reputation points Microsoft Employee

2024-03-06T06:52:57.7233333+00:00

Apologies you are still facing this issue. I have reached out to you privately to get more info about your subscription.
V1xIII 0 Reputation points

2024-04-11T18:55:01.67+00:00

Update on this issue. I found that I can successfully create a TLS/SSL binding with an app managed certificate for www.mywebsite.com, but not for mywebsite.com (without the www). I am following the same procedure and it successfully verifies before I click "add", but it still never completes the process.
ajkuma 27,591 Reputation points Microsoft Employee

2024-04-15T09:50:04.1366667+00:00

Thanks for the follow-up and update. App Service certificate ( ASC) vs App Service managed certificate ( ASMC) has a limitations https://learn.microsoft.com/azure/app-service/configure-ssl-certificate?tabs=apex#create-a-free-managed-certificate

Also, please check this discussion thread: https://learn.microsoft.com/en-us/answers/questions/1350515/azure-cannot-add-managed-certificate-to-www-mydoma
V1xIII 0 Reputation points

2024-05-22T18:29:37.16+00:00

Latest Update: I successfully added a binding/cert for www.mywebsite.com, but I still cannot create one for the non-www version. It still shows as in progress for hours in the notification and then fails with the same non-descriptive error message. As far as I can tell, everything should be set up the same for it in CloudFlare as it is for the www version.

2 answers

V1xIII 0 Reputation points

2024-05-22T18:41:24.6166667+00:00

I finally figured this out thanks to a Reddit user. I had access restrictions in place (only open to a couple personal IP's as well as any IP addresses associated with my Azure site) and this was apparently causing the issue with the custom binding / certificate creation. Strange that the www binding/certificate was created without issue while the access restrictions were active.
Please sign in to rate this answer.
Lex Li (Microsoft) 5,662 Reputation points Microsoft Employee

2024-05-23T02:27:42.1766667+00:00

Great that you found the cause. BTW, Cloudflare has many other settings that might impact on certificate creation, so my personal opinion is to disable Cloudflare for a few minutes while Azure analyzes your DNS settings and requests the certificates, and re-enable afterwards.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
V1xIII 0 Reputation points

2024-05-22T18:43:49.9+00:00

I finally figured this out thanks to a user on the Azure subreddit. I tried disabling my access restrictions (it was locked down for everything but a couple personal IPs and the Azure addresses for my site) and I was able to create the binding / certificate. Strange that the www one worked fine while those were active.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Error when trying to add an App Service Managed Certificate

2 answers

Your answer