Azure Static Web App certificate & custom domain expired

Question

Azure Static Web App certificate & custom domain expired

Steven V 0

First the SSL certificate expired and then I also noticed my custom domain expiry date had also passed.

The status for my custom domain doesn't resolve and just shows the spinning icon. I removed the domain and try adding again but am getting the following error.

CNAME Record is invalid. Please ensure the CNAME record has been created.

I verified with my network engineer that the record is listed in our domain controller.

I have 3 other environments that are also about to expire. Please help, I'd like to resolve this asap!

Silvia Wibowo 6,041 Reputation points Microsoft Employee Volunteer Moderator

2025-04-15T22:41:51.8733333+00:00

Hi @Anonymous , custom domain purchased from Azure Static Web App appears as "App Service Domains" in Azure Portal. It can be manually renewed up to 18 days after domain expiration. You can enable domain auto-renewal policy to reduce the management overhead of this operations.

If you've passed 18 days after expiration, you can try contacting the domain registrar: GoDaddy. Every website domain purchased from Azure Portal is hosted by GoDaddy. Reference: https://www.godaddy.com/en/help/contact-us
Steven V 0 Reputation points

2025-04-16T15:50:57.7033333+00:00

Hello @Silvia Wibowo I'm not understanding what to do. Long story short, my custom domain was brought over from another DNS. The SSL expired and so did the custom domain.

I removed and try re-adding doing the same exact steps a year ago. I used the "Custom domain on other DNS" option.

I filled out and made sure the CNAME is hosting on my domain controller, however, I receive this error.

Here's another example of another custom domain that is working and set to expire in another Static Web App.

How can I prevent this from expiring and re-add my existing custom domain?
Silvia Wibowo 6,041 Reputation points Microsoft Employee Volunteer Moderator

2025-04-16T20:05:31.95+00:00
Hi @Steven V ,

So, your custom domain was not purchased from Azure portal. It is from external domain registrar and the DNS record is hosted on an external DNS (not Azure DNS). In this case, Azure Static Web Apps creates a free SSL/TLS certificate for the custom domain you added.

After the domain is added, one of the following conditions must be met for automatic certificate renewal to work:

Ensure that the public internet CNAME DNS record used to add the custom domain to the Static Web App via CNAME validation is still present. This option is only valid if CNAME validation was used to add the domain to the static web app.

Ensure that the custom domain resolves to the static web app over public internet. This option is valid regardless of the validation method used to add the domain to the web app. This approach is valid even when you enable private endpoints. The purpose of a private endpoint for Static Web Apps is to block internet access to the site contents, but not to block internet DNS resolution to the site.
Bhargavi Naragani 5,270 Reputation points Microsoft External Staff Moderator

2025-04-18T01:14:19.3333333+00:00

Hi @Steven V ,
Just checking in to see if the above information provided by @Silvia Wibowo helped.

In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Siva Nair 2,340 Reputation points Microsoft External Staff Moderator

2025-04-21T11:35:57.96+00:00

Hi @Steven V , Just checking in to see if the above information provided by @Silvia Wibowo helped.

In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Silvia Wibowo 6,041 Reputation points Microsoft Employee Volunteer Moderator

2025-04-15T22:41:51.8733333+00:00

Hi @Anonymous , custom domain purchased from Azure Static Web App appears as "App Service Domains" in Azure Portal. It can be manually renewed up to 18 days after domain expiration. You can enable domain auto-renewal policy to reduce the management overhead of this operations.

If you've passed 18 days after expiration, you can try contacting the domain registrar: GoDaddy. Every website domain purchased from Azure Portal is hosted by GoDaddy. Reference: https://www.godaddy.com/en/help/contact-us
Steven V 0 Reputation points

2025-04-16T15:50:57.7033333+00:00

Hello @Silvia Wibowo I'm not understanding what to do. Long story short, my custom domain was brought over from another DNS. The SSL expired and so did the custom domain.

I removed and try re-adding doing the same exact steps a year ago. I used the "Custom domain on other DNS" option.

I filled out and made sure the CNAME is hosting on my domain controller, however, I receive this error.

Here's another example of another custom domain that is working and set to expire in another Static Web App.

How can I prevent this from expiring and re-add my existing custom domain?
Silvia Wibowo 6,041 Reputation points Microsoft Employee Volunteer Moderator

2025-04-16T20:05:31.95+00:00

Hi @Steven V ,

So, your custom domain was not purchased from Azure portal. It is from external domain registrar and the DNS record is hosted on an external DNS (not Azure DNS). In this case, Azure Static Web Apps creates a free SSL/TLS certificate for the custom domain you added.

After the domain is added, one of the following conditions must be met for automatic certificate renewal to work:

Ensure that the public internet CNAME DNS record used to add the custom domain to the Static Web App via CNAME validation is still present. This option is only valid if CNAME validation was used to add the domain to the static web app.

Ensure that the custom domain resolves to the static web app over public internet. This option is valid regardless of the validation method used to add the domain to the web app. This approach is valid even when you enable private endpoints. The purpose of a private endpoint for Static Web Apps is to block internet access to the site contents, but not to block internet DNS resolution to the site.
Bhargavi Naragani 5,270 Reputation points Microsoft External Staff Moderator

2025-04-18T01:14:19.3333333+00:00

Hi @Steven V ,
Just checking in to see if the above information provided by @Silvia Wibowo helped.

In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Siva Nair 2,340 Reputation points Microsoft External Staff Moderator

2025-04-21T11:35:57.96+00:00

Hi @Steven V , Just checking in to see if the above information provided by @Silvia Wibowo helped.

In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Steven V 0

It's resolved. Adding aCNAME worked on our DNS but I need the site to be private.

Creating an alias name on our internal domain controller stopped working.

So I used Azure Front Door to map to web and updated DC with endpoint.

Silvia Wibowo 6,041 Reputation points Microsoft Employee Volunteer Moderator

2025-04-22T05:13:47.6466667+00:00
Hi @Steven V , you don't need a Front Door.

To verify your domain, you need a CNAME record on your public DNS that points custom domain to the public endpoint (default domain of your Static Web App). This is required for Static Web App to automatically renew the TLS certificate of your custom domain.

Create a private endpoint for your Static Web App. It will respond with a 403 status code if the request comes from a public IP address. The only way to reach the app is to use the private endpoint deployed within your VNet.

Add an alias name in your internal Domain Controller, mapping the custom domain to the private endpoint.

Clients from internet resolve custom domain to public endpoint but their access is blocked (403 status code).

Clients from internal (that resolves the custom domain using internal Domain Controller) resolve custom domain to private endpoint and they can access your Static Web App.
Bhargavi Naragani 5,270 Reputation points Microsoft External Staff Moderator

2025-04-23T04:57:55.28+00:00

Hi @Steven V,

Just checking in to see if above information provided by Silvia Wibowo was helpful. If you have any further updates on this issue, please feel free to post back.

Share via

Azure Static Web App certificate & custom domain expired

1 answer

Your answer