Does Azure Front Door produce a new validation token prior to apex domain certificate expiry?

Question

Does Azure generate a new validation token in advance of the certificate expiry for an apex domain and this new token (not the old one) can be retrieved from the ValidationPropertyValidationToken property of the Get-AzFrontDoorCdnCustomDomain powershell command?

I understand that for Apex domains its necessary to manually update the _dnsauth validation token within the domain registrar before a new certificate can be issued, as such we are looking at creating an automated script which fetches the new token from the aforementioned command and updates the DNS record in Azure DNS.

For this script to work, it assumes Azure generates a new token in advance of the expiry. Is this true? If so how far in advance?

Answer 1

Hello Elliot Stansfield

Azure Front Door generates a new validation token for custom domains, including apex domains, when the current certificate is about to expire.

• To validate a domain, you need to create a DNS TXT record. The name of the TXT record should be in the format _dnsauth.{subdomain}. Azure Front Door will provide a unique value for your TXT record when you begin adding the domain to Azure Front Door.
• When using an Azure Front Door-managed certificate, Azure Front Door automatically attempts to renew the certificate. Before renewing, Azure Front Door verifies if the DNS CNAME record still points to the Azure Front Door endpoint.
• However, for Apex domains, if there is no CNAME record pointing to an Azure Front Door endpoint, the autorotation for managed certificates will fail until domain ownership is revalidated.
• Select the Pending revalidation link and then select the Regenerate button to regenerate the TXT token. After that, add the TXT token to the DNS provider settings.

Check the below documents for more understanding:

Apex domains in Azure Front Door

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-how-to-onboard-apex-domain?pivots=front-door-standard-premium

---

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.