This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 82%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EV%3C/text%3E%3C/svg%3E)
I'm trying to add an App Service Managed Certificate to my site, and it keeps failing after hours of trying to complete. I've tried from the certificates page, as well as from the custom domains page in the "add binding" menu. The status on my custom domain says "no binding" at the moment.
I have added the CAA record to my Cloudflare DNS records (0 issue digicert.com).
My plan is currently Basic (B1), location is South Central US.
I have no other certificates currently.
Error details:
I'm sure I'm missing something simple, pretty new at this side of things.
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 55.00000000000001%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAK%3C/text%3E%3C/svg%3E)
@V1xIII , Just to clarify, is this issue confined only to South Central US?
If you haven't done, you may leverage App Service diagnostics from Azure Portal> Navigate to your App Service app in the Azure Portal.
In the left navigation, click on Diagnose and solve problems - Review - "SSL and Domains" and “Configuration and Management” options.
If your requirement fits, you may try deploying certificate in another proximity region or re-try the operation and let us know.
I don't see anything on the pages you suggested that indicates why I can't create a managed certificate. I attempted to move my app service to another US region, but it seems that South Central US is the only region I can deploy on (I tried most of the others). "1 resource(s) have been removed from your original selection as they cannot move to the destination". I am currently in the 30 day free trial, if that makes a difference.
Thanks for the follow-up and additional info.
There are a few conditions for moving an - Move an App Service resource to another region (checkout the doc guidance). Also, see App Service limits.
Since you are able to provision the resource (managed certificate) on other regions, you may leverage the same. I'll also relay this feedback internally to our product team.
I have not yet found a solution. It looks like I'll have to handle my certificates manually. I am not able to move my app to any of the other regions I've attempted, and I am still unable to create a managed certificate.
Apologies you are still facing this issue. I have reached out to you privately to get more info about your subscription.
Update on this issue. I found that I can successfully create a TLS/SSL binding with an app managed certificate for www.mywebsite.com, but not for mywebsite.com (without the www). I am following the same procedure and it successfully verifies before I click "add", but it still never completes the process.
Thanks for the follow-up and update. App Service certificate ( ASC) vs App Service managed certificate ( ASMC) has a limitations https://learn.microsoft.com/azure/app-service/configure-ssl-certificate?tabs=apex#create-a-free-managed-certificate
Also, please check this discussion thread: https://learn.microsoft.com/en-us/answers/questions/1350515/azure-cannot-add-managed-certificate-to-www-mydoma
Latest Update: I successfully added a binding/cert for www.mywebsite.com, but I still cannot create one for the non-www version. It still shows as in progress for hours in the notification and then fails with the same non-descriptive error message. As far as I can tell, everything should be set up the same for it in CloudFlare as it is for the www version.
I finally figured this out thanks to a user on the Azure subreddit. I tried disabling my access restrictions (it was locked down for everything but a couple personal IPs and the Azure addresses for my site) and I was able to create the binding / certificate. Strange that the www one worked fine while those were active.
I finally figured this out thanks to a Reddit user. I had access restrictions in place (only open to a couple personal IP's as well as any IP addresses associated with my Azure site) and this was apparently causing the issue with the custom binding / certificate creation. Strange that the www binding/certificate was created without issue while the access restrictions were active.
Great that you found the cause. BTW, Cloudflare has many other settings that might impact on certificate creation, so my personal opinion is to disable Cloudflare for a few minutes while Azure analyzes your DNS settings and requests the certificates, and re-enable afterwards.