Site suddenly claims ssl certificate was revoked

Question

I converted my service to extended support. Later, I successfully updated my SSL certificate and things were running fine until recently, when the browser claims the SSL certificate has been revoked. I checked with GoDaddy, and the certificate is current and active.

1. Has there been any service change that would cause this?
2. Is there some Azure feature not configured by the conversion process that could affect this?
3. If I have to rekey and reinstall the certificate, is there a way Azure can generate a CSR I can use with GoDaddy (rather than using my local IIS)?

Answer 1

Hi Mark Zuckerman,

Check if the certificate thumbprint in your Azure portal matches the one that GoDaddy issued.
See that if your app’s network security group (NSG) or other firewall rules allow outbound access to GoDaddy’s CRL and OCSP URLs.
In Cloud Services (Extended Support), certs are stored in the certificates section of your ARM template or uploaded via the portal or CLI. Check that the new certificate is uploaded via the Azure portal or CLI with a .pfx file. Your ServiceConfiguration.Cloud.cscfg file has the correct thumbprint.

1. Has there been any service change that would cause this?
Azure occasionally updates its trusted root certificates. If GoDaddy’s chain relies on an older root that Azure no longer trusts, browsers may flag it as revoked
If your AES VM or App Gateway cannot reach GoDaddy’s Online Certificate Status Protocol (OCSP) or Certificate Revocation List (CRL) endpoints due to firewall/NSG rules, browsers may fail revocation checks.

2. Is there some Azure feature not configured by the conversion process that could affect this?
When you move to Cloud Services (Extended Support) in Azure, the underlying infrastructure changes. The new model is based on ARM (Azure Resource Manager) rather than ASM (Azure Service Manager). Some potential causes of SSL cert revocation issues after migration could be raised.

3. If I have to rekey and reinstall the certificate, is there a way Azure can generate a CSR I can use with GoDaddy (rather than using my local IIS)?
Azure doesn’t directly generate CSRs for you, it expects you to upload a PFX file (certificate + private key). However, if you're using Key Vault, App Services, or Application Gateway, Azure can generate a CSR for those resources.For Cloud Services (Extended Support), you need to: Generate the CSR using IIS, OpenSSL, or Key Vault. Get the cert from GoDaddy. Convert it to a PFX (if needed). Upload it to Azure.

For detailed information, please check: Update or change the certificate used in Azure Cloud Services (extended support)

If you have any further queries, let me know. If the information is helpful, please click on Upvote.

Answer 2

I rekeyed my ssl certificate and now things appear to be working. I got mixed messages from GoDaddy about the revocation issue. So I'll wait a few days to see if GoDaddy revokes. Thanks for checking in.