Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
8,993 questions
Unable to generate SSL certificates on Azure Web App
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 0%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Raphael Pereira
20
Reputation points
I'm having the following issue when trying to generate a new certificate to my azure web app:
Error adding managed certificate: Properties.CanonicalName is invalid. Found a duplicate certificate with [...] available or in pending issued under serverFarmId /subscriptions/[...]/resourceGroups/[...]/providers/Microsoft.Web/serverfarms/[...]. Pending certificate operation id: [...], timeout: 5/8/2024 10:18:00 AM.
I can't find anywhere the said "pending certificate" so I could cancel the operation.
I used to have the certificate there, it expired and I deleted it to generate a new one, which now isn't possible. Any help?
Azure App Service
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 55.00000000000001%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
ajkuma 28,036 Reputation points Microsoft Employee Moderator2024-05-06T18:40:46.4366667+00:00 @Raphael Pereira , Apologies for the delay from over the weekend.
If you haven't done already so, App Service Managed Certificate, are fee certificates are issued by DigiCert. For some domains, you must explicitly allow DigiCert as a certificate issuer by creating a CAA domain record with the value:
0 issue digicert.com.I have seen similar cases where by completing the above the error goes away.
For more details on App Service Managed certificate, please see these docs: Prerequisites and Limitations.
If the issue still persist kindly check using Azure Resource Explorer to see if there are any remnants of your SSL certificate?
- Navigate to https://resources.azure.com/
- Expand subscriptions>your subscription>resource groups>your resource group>providers>Microsoft.Web>Your Web App Name
- See if you are able to locate any remnants of your SSL certificate in here and attempt to delete them by going into the actions (post,delete) section
If the answer helped (pointed, you in the right direction) > please click Accept Answer - it will help users to find the answers quickly.
-
ajkuma 28,036 Reputation points Microsoft Employee Moderator
2024-05-09T12:35:33.4533333+00:00 @Raphael, If the answer helped (pointed you in the right direction) > please click Accept Answer Or please share the requested/more info to help you better.
-
Raphael Pereira 20 Reputation points
2024-05-09T14:49:11.63+00:00 @Raphael Pereira , Apologies for the delay from over the weekend. If you haven't done already so, App Service Managed Certificate, are fee certificates are issued by DigiCert. For some domains, you must explicitly allow DigiCert as a certificate issuer by creating a CAA domain record with the value:
0 issue digicert.com. I have seen similar cases where by completing the above the error goes away. For more details on App Service Managed certificate, please see these docs: Prerequisites and Limitations. If the issue still persist kindly check using Azure Resource Explorer to see if there are any remnants of your SSL certificate?- Navigate to https://resources.azure.com/
- Expand subscriptions>your subscription>resource groups>your resource group>providers>Microsoft.Web>Your Web App Name
- See if you are able to locate any remnants of your SSL certificate in here and attempt to delete them by going into the actions (post,delete) section
This didn't help.
I've added the CAA record (which wasn't required before for some reason and the domain had an SSL certificate for 6 months until stop working now) and it didn't fix the problem.
I've also looked for remnants of the old SSL certificate or the new one that as triggered and there isn't anything related to it in the UI.
-
ajkuma 28,036 Reputation points Microsoft Employee Moderator
2024-05-10T04:31:45.31+00:00 Thank you for following up and providing the update. In order to perform closer investigation, we require your Azure resource info. I have contacted you privately for this purpose.
Note: Kindly do not share any PII data on the public forum.
Sign in to comment
Sign in to answer