This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 70%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
The create pane writes "Hostname eligible for certificate creation. Click Create to create your App Service Managed Certificate."
But when I click "Create", the Creation fails with "Failed to create App Service Managed Certificate for hostname abc.mydomain.com. Click here for more details. Error Details: Properties.CanonicalName is invalid. Certificate creation failed unexpectedly for canonical name abc.mydomain.com"
The DNS for mydomain.com:
I was able to successfully create an App Service Managed Certificate for hostname xyz.mydomain.com, but I cannot create one for abc.mydomain.com. The documentation states: "You can create only one certificate for each supported custom domain." But these are different subdomain and are connected to different app services. Does anyone know what the problem could be?
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(313.6, 87%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
This is because free certificate is generated by digicert.com and some domain names need it to be explicitly defined.
Simply add CAA record in your domain name host record listings with value: 0 issue digicert.com
And try creating app service managed certificate again. I hope so it will work and create ssl certificate immediately.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 4%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJJ%3C/text%3E%3C/svg%3E)
I think you'll find that your issue is because the free certificate is only supported for a single top level domain. So for example:
abc.mydomain.com will issue
def.mydomain.com will not issue
ghi.myotherdomain.com will issue
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(220.8, 13%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETU%3C/text%3E%3C/svg%3E)
I had the similar issue:
Properties.CanonicalName is invalid. Found a duplicate certificate with (domain) available or in pending issued under serverFarmId /subscriptions/... Pending certificate operation id: (guid) , timeout: 8/10/2021 12:50:20 PM.
And I just needed to wait for the process to complete. Some 30 minutes (In that time frame, I almost lost my mind in constantly trying to create the certificate...). So for anyone having similar issue, maybe you just have to wait.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 38%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERS%3C/text%3E%3C/svg%3E)
I also get this error:
Properties.CanonicalName is invalid. Found a duplicate certificate with .... available or in pending issued under serverFarmId ... Pending certificate operation id: ...
and after a week of waiting and contacting azure support still no progress.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 1%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDC%3C/text%3E%3C/svg%3E)
I have successfully created certs for a.domain.com, b.domain.com and c.domain.com so I don't think it's that.
it could be because you need a CAA record for abc.mydomain.com. See here for details:
Note
The free certificate is issued by DigiCert. For some top-level domains, you must explicitly allow DigiCert as a certificate issuer by creating a CAA domain record with the value: 0 issue digicert.com.