Cannot create App Service Managed Certificate with error "Only letters and numbers are allowed"

Stewart Rand 71

I am attempting to add a free managed certificate to my app services, but receiving the following error:

Properties.CanonicalName is invalid. Canonical name www-uat.example.com.au includes at least one special character. Only letters and numbers are allowed.

However, I was able to successfully create a certificate in another subscription (same azure region, and naming format [www-prod.example.com.au]) about a week ago, and have previously never had issues requesting certificates with hyphens in the name. I cannot find any documentation or troubleshooting posts mentioning this limitation - has this been changed recently?

The portal shows a green tick when attempting to request, but gives the above error when clicking 'Create'

Hostname eligible for certificate creation. Click Create to create your App Service Managed Certificate.

Deploying via ARM template gives the same error.

Status Message: Properties.CanonicalName is invalid. Canonical name www-uat.example.com.au includes at least one special character. Only letters and numbers are allowed. (Code: BadRequest)

Other variations of this URL format also fail (www-dev.example.com.au, authoring-uat.example.com.au).

Grmacjon-MSFT 18,451 Reputation points

2021-06-15T06:55:06.77+00:00

Thanks for bringing this to our attention @Stewart Rand . This is odd behavior. We will check in with the engineering team to see if there's a fix or a possible workaround for this error and will update this thread

Best,
Grace
06447697 6 Reputation points

2021-06-15T08:45:07.493+00:00

Hi, I'm getting the same issue.
On Friday 11th June (4days ago) I successfully created 6 Webapps with custom domains all with the same format (xxx.dev.xxx-xxx.co.uk) . Yesterday spent all day trying to add another in a slightly different format (extra sub-domain) and kept getting the below error. Finally thought it was something I was doing wrong and rolled it all back but now I cannot re-add the certificate which I added OK on Friday, getting the same error below.

Properties.CanonicalName is invalid. Canonical name xxx.dev.xxx-xxx.co.uk includes at least one special character. Only letters and numbers are allowed.
Grmacjon-MSFT 18,451 Reputation points

2021-06-15T17:21:40.277+00:00

Hello @Stewart Rand and @06447697 I got confirmation from the engineering team that this is a bug. The team is working on a fix but we don't have a sharable ETA at this moment. I will update you as soon as a fix is rolled out. We sincerely apologize for the inconvenience this issue has caused.

We appreciate your patience as we work to resolve this issue.

Thanks,
Grace
Moses Yap 1 Reputation point

2021-06-16T01:02:39.063+00:00

Getting the same error. This seemed to be a rather bad bug since I would guess lots and lots of test URLs would have -dev or -int on them.
Grmacjon-MSFT 18,451 Reputation points

2021-06-16T04:26:59.7+00:00

Hi @Moses Yap ,

We apologize for the inconvenience this issue has caused. The App Service Managed Certificate team is working internally to fix this issue. Thanks for your patience.

-Grace
Anand Srivastava 1 Reputation point

2021-06-16T07:58:40.987+00:00

Even i am getting this issue when trying to create the certificate from "Create App Service Managed Certificates"
Bjarki Heiðar 1 Reputation point

2021-06-16T10:33:56.277+00:00

We are having the same issue. We will be monitoring this issue.
Rob Weber 1 Reputation point

2021-06-16T11:37:16.723+00:00

Hi - we are experiencing an issue with this as well, and has a big impact on us. Please escalate / remedy ASAP.
thanks,
Rob
Klautke Philipp 1 Reputation point

2021-06-16T13:52:54.31+00:00

We also have this error. Please find solution quickly!
R2DHart 1 Reputation point

2021-06-16T15:54:11.13+00:00

Same here. I assumed it was due to a lack of knowledge on my part.
Robert Simmons 11 Reputation points

2021-06-16T20:51:39.673+00:00

Just ran into this as well. Following for updates - we have customers waiting on their SSL certificates.
Shibendra Das 1 Reputation point

2021-06-17T12:00:03.683+00:00

I am not able to create resource group. I am following this link to create a deployment. but got error :
Weblink : https://learn.microsoft.com/en-us/learn/modules/azure-architecture-fundamentals/exercise-create-website

After i reached the template i was using resource group id : learn-d7aa4692-58b0-4850-8636-e3d381b16668

Now i am trying to create resource group it is asking me to register

Can anyone help?
ajkuma 26,466 Reputation points Microsoft Employee

2021-06-18T07:48:57.583+00:00

@Shibendra Das , The issue you posted is not the same as the original issue on this thread, so we request you to create a new forum thread.
// @Grmacjon-MSFT
giovanni.fleres 6 Reputation points

2021-06-18T13:06:19.773+00:00

I also got the same issue since a couple of days
Katrin Dubois 1 Reputation point

2021-06-22T18:58:50.99+00:00

Hello, we have the same problem, Germany West. Can you please let us know when its fixed?
Katrin Dubois 1 Reputation point

2021-06-22T18:59:04.503+00:00

Hello, we have the same problem, Germany West. Can you please let us know when its fixed?
Rich Williams 6 Reputation points

2021-09-01T14:55:37.957+00:00

Hello

1st September 2021

We are also getting this issue with the German umlaut character ü. App service in Germany West Central

Any help will be appreciated

Accepted answer

Grmacjon-MSFT 18,451 Reputation points

2021-06-23T22:33:10.61+00:00

Hello everyone,

This issue is now resolved. The fix has been deployed to every region. Thank you so much for your patience!

Best,
Grace
Please sign in to rate this answer.

1 person found this answer helpful.
Robert Simmons 11 Reputation points

2021-06-24T00:09:02.707+00:00

@Grmacjon-MSFT I am still getting this in a central-us resource group. Tried both through the portal and the Azure CLI.

"Properties.CanonicalName is invalid. Canonical name (something with only a hyphen in it) includes at least one special character. Only letters and numbers are allowed."

Yuta Wakita 6 Reputation points

2021-06-24T02:34:39.497+00:00

Ditto to @Robert Simmons
I still got the same error right now in JapanEast if a CN includes a hyphen.

Benjamin Akhtary 11 Reputation points

2021-06-24T08:06:34.483+00:00

we have same issue with centeral-us. as of jun 24th-2021.

drdamour 16 Reputation points

2021-06-24T15:26:12.017+00:00

confirmed NOT WORKING in us west 2, any ETA?

Grmacjon-MSFT 18,451 Reputation points

2021-06-24T23:17:15.57+00:00

Hi All ( @Robert Simmons , @Yuta Wakita , @Benjamin Akhtary , @drdamour )

Apologies for the inconvenience this issue has caused. it looks like there are still a few more regions the fix is being deployed to. We will keep updating this thread daily with any new updates from the engineering team.

Thanks,
-Grace

Sean 11 Reputation points

2021-06-28T14:03:46.047+00:00

Still happening for me in central-us

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-28T18:38:29.067+00:00

@Sean , The deployment is still in progress for central-us. I'm constantly in touch with our engineering team and I'll post back as soon as I hear from them.

Apologies for the inconvenience!

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-28T19:09:40.663+00:00

@Yuta Wakita , Thanks for your patience. Deployment for JapanEast was completed. Please try to recreate an App Service Managed Certificate for your app(s) and confirm that it is working. if you run into any other issues please let us know.

Jack.Lin 1 Reputation point

2021-06-29T09:10:51.377+00:00

Hi Grace,

We still have the same issue in East Asia, need your help, thank you.

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-29T19:20:04.387+00:00

@Jack.Lin , The deployment is still not complete for East Asia. I'm constantly in touch with our engineering team and I'll post back as soon as I hear from them.

I completely understand the concern, we apologies for the inconvenience this issue has caused.

Erik O'Leary 1 Reputation point

2021-06-29T19:42:56.847+00:00

Why not mark this as 'unresolved' until it actually is so we dont have to dig through the comment tree to see where in the process it is?

Kunal Bhambhani 1 Reputation point

2021-06-29T19:58:56.19+00:00

Hi @Grmacjon-MSFT :
I am trying to create an App Service Managed certificate in East US 2 and still getting the same error.
Region : US East 2
Hostname: www-legacy-dev.<companyname>.com
Error: Properties.CanonicalName is invalid. Canonical name www-legacy-dev.<companyname>.com includes at least one special character. Only letters and numbers are allowed.

Yuta Wakita 6 Reputation points

2021-06-30T07:36:04.57+00:00

Hi @ajkuma ,
I finally succeeded to create a managed cert in Japan East!
Thank you for notifying me.

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-30T12:26:56.37+00:00

@Yuta Wakita , Glad you were able to create the certificate fine. Thanks for the update.

R2DHart 1 Reputation point

2021-06-30T12:58:07.027+00:00

Still getting this error in South Central US as well. :(

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-30T13:03:39.063+00:00

@Kunal Bhambhani , The deployment to East US 2 was expected to complete by now. I'll confirm on this and follow-up. Apologies for the delay and all the inconvenience.

Robert Simmons 11 Reputation points

2021-06-30T13:16:41.367+00:00

@Grmacjon-MSFT Central-US is working now too.

Grmacjon-MSFT 18,451 Reputation points

2021-06-30T19:39:48.633+00:00

Thanks for confirming @Robert Simmons !

Grmacjon-MSFT 18,451 Reputation points

2021-06-30T20:01:32.48+00:00

Hi @Kunal Bhambhani , can you please try again? the deployment to East US 2 is now complete.

Thanks,
Grace

Sean 11 Reputation points

2021-06-30T21:11:34.307+00:00

central-us is working. Have created a number of certificates with dash in sub-domain

Jack.Lin 1 Reputation point

2021-07-01T01:41:30.213+00:00

Confirmed it works in East Asia, thank you.

ajkuma 26,466 Reputation points Microsoft Employee

2021-07-01T06:07:38.923+00:00

@Sean , Glad you were able to create the certificate fine. Thanks for the update.

Again, we appreciate your patience through this.

ajkuma 26,466 Reputation points Microsoft Employee

2021-07-06T17:55:41.793+00:00

The deployment was complete in all the regions. In case, anyone is still seeing this issue. Please let us know. We will follow-up with you immediately.

Once again, I completely understand this issue was frustrating and we sincerely apologies for all the inconvenience this has caused.
Please be rest assured we have also relayed the feedback to our product engineering team.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

5 additional answers

Grmacjon-MSFT 18,451 Reputation points

2021-06-17T04:52:47.613+00:00

Hi everyone,

We apologize for the frustration and impact this issue has caused. Thank you so much for your patience. The engineering team deployed a fix which should be rolling out over the next week.

Best,
Grace
Please sign in to rate this answer.

1 person found this answer helpful.
Rob Weber 1 Reputation point

2021-06-17T11:29:26.347+00:00

Thanks Grace! Could you provide a bit more information on the roll out? Will certain regions be rolled out first? Will we be updated when the roll-out is completed?
Regards,
Rob

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-18T07:46:19.103+00:00

@Rob Weber ,

Yes, typically the rollout would happen to certain regions first, and we avoid deploying to paired Regions at the same time (for example, East US and West US).
We will continue to post an update here on the progress and/ as we have more information available from our product team.

I completely understand this issue could be frustrating. Our product engineering team is actively working on it. As Grace mentioned, the fix is deployed which should be rolling out over the next week, but we do not have an exact ETA to share.

At this time - currently if the name contains “-“. If feasible, please use a different hostname until the fix is rolled out.

Thanks for your patience on this!

Mark Morrall 6 Reputation points

2021-06-18T09:41:06.817+00:00

Thanks for the update. Can you confirm that the fix also includes the scenario where the special character (hyphen in my case) is in the domain name? For example www.some-name.co.uk

giovanni.fleres 6 Reputation points

2021-06-18T13:08:10.327+00:00

Hi @Grmacjon-MSFT ,
Please can you be more precise about when the fix should be applied in the West Europe region ?
We deploy numeorus Web Apps and most of them have a "-" in their domain name

Thanks
Giovanni

Petr Markus 1 Reputation point

2021-06-18T13:58:56.897+00:00

"+1" for West Europe. Same problem as giovanni - domain name with "-".
Timeframe would be most appreciated.
Thanks
PM

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-19T18:04:04.95+00:00

Yes, the fix would resolve that issue. Thanks!

Nghĩa Ngô 6 Reputation points

2021-06-20T10:11:56.97+00:00

The same here. can you please let us know when Southeast Asia has been fixed ? Thanks

Hannes 16 Reputation points

2021-06-20T15:44:53.817+00:00

I'm facing the same issue. West Europe region. The domain of my website has a "-"

Grmacjon-MSFT 18,451 Reputation points

2021-06-21T07:47:45.353+00:00

Hi @giovanni.fleres , @Hannes , @Petr Markus ,

We will check internally with the engineering team to see if the fix has been completed in the West Europe region and update this thread. The estimated timeframe for completion for all regions is about 7 business days. Thanks for your patience.

Best,
Grace

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-21T18:30:09.737+00:00

@giovanni.fleres , @Hannes , @Petr Markus ,
// @Grmacjon-MSFT

To keep you posted: West Europe is rolling right now. Thanks for your patience!

Grmacjon-MSFT 18,451 Reputation points

2021-06-21T21:59:19.457+00:00

Hello @giovanni.fleres , @Hannes , @Petr Markus ,

:The deployment for West Europe is now completed. Please try to recreate an app service manage cert for your app(s) and confirm that it is working. if you run into any other issues please let us know.

Best,
Grace

Grmacjon-MSFT 18,451 Reputation points

2021-06-21T22:02:26.38+00:00

Hi nngo-007, yes we will update you when deployment for Southeast Asia is complete. We appreciate your patience.

Thanks,
Grace

Gronauer, Marcel 1 Reputation point

2021-06-22T05:53:05.407+00:00

The same here. can you please let us know when North Europe has been fixed ? Thanks

CB-Elite 11 Reputation points

2021-06-22T07:30:52.163+00:00

Hi @Grmacjon-MSFT UK South is still giving the same error message - please could you confirm when this will be fixed? Thanks

Petr Markus 1 Reputation point

2021-06-22T08:08:48.523+00:00

WE rolled out. hyphened-domain confirmed working. Thanx

Hannes 16 Reputation points

2021-06-22T09:43:45.33+00:00

@Grmacjon-MSFT For me it is not working. After around 2h waiting it failed to create the certificate. In Activity Log I can see the error:
Error code: ResourceOperationFailure
Message: The resource operation completed with terminal provisioning state 'Failed'.

Grmacjon-MSFT 18,451 Reputation points

2021-06-22T10:00:30.287+00:00

@Hannes thanks for the update! We are sorry you are still facing issues with creating a cert. I will share this feedback internally with the engineering team to see if there is a workaround and will update this thread accordingly.

Best,
Grace

Grmacjon-MSFT 18,451 Reputation points

2021-06-22T10:02:47.44+00:00

Hi @Gronauer, Marcel ,

Yes, we will update you when deployment for North Europe is complete. We appreciate your patience.

Thanks,
Grace

Grmacjon-MSFT 18,451 Reputation points

2021-06-22T10:06:37.987+00:00

Hello @CB-Elite ,

We will update this thread when the fix has been deployed for the UK South region. We sincerely apologize for the inconvenience this issue caused. Thanks for your patience.

-Grace

Grmacjon-MSFT 18,451 Reputation points

2021-06-22T10:08:53.007+00:00

Thanks for confirming, @Petr Markus . Happy to hear you are now able to create a free managed certificate :)

giovanni.fleres 6 Reputation points

2021-06-22T10:41:44.813+00:00

Hi @Grmacjon-MSFT ,
I've tried to deploy a few Web App with a managed certificate in the West Europe region and below there are my results:

Now it is supported again to use "-" in the Web App domain name

Compared to the past, the deployment process of a new managed certificate is taking longer ( from two to four minutes)

My DNS zone is hosted in CloudFlare and in the past I had not any time sync issue between Azure Web App deployment and their DNS records creation (required to generate the managed certificate). Now I wait sometime before Azure is aware of the new records

Rodrigo Marques 11 Reputation points

2021-06-22T12:56:01.643+00:00

Could you please provide the deploy timeline for East US? I'm still getting this error.

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-22T13:23:12.71+00:00

@giovanni.fleres , Glad you were able to create the certificate. Thanks for sharing your observations, we're ( @Grmacjon-MSFT ) following-up on that (lag issue) internally and will post back soon.

Sorry for that inconvenience!

Hannes 16 Reputation points

2021-06-22T14:51:42.837+00:00

IIt worked now for me, thanks @Grmacjon-MSFT

Grmacjon-MSFT 18,451 Reputation points

2021-06-22T18:41:46.137+00:00

Hello @Rodrigo Marques ,

Thanks for your patience. Deployment for East US is now completed. Please try to recreate an app service manage cert for your app(s) and confirm that it is working. if you run into any other issues please let us know.

Best,
Grace

Rodrigo Marques 11 Reputation points

2021-06-22T20:55:18.967+00:00

Thanks @Grmacjon-MSFT , it's now working.

Nghĩa Ngô 6 Reputation points

2021-06-23T03:31:04.413+00:00

Thanks teams. It fixed. I can create cert. now.

Grmacjon-MSFT 18,451 Reputation points

2021-06-23T07:52:09.147+00:00

Thanks for confirming @Hannes .

Grmacjon-MSFT 18,451 Reputation points

2021-06-23T07:54:54.54+00:00

Thanks for confirming @Nghĩa Ngô . Glad you can now create a cert.

ajkuma 26,466 Reputation points Microsoft Employee

2021-06-23T08:33:03.517+00:00

@giovanni.fleres , The issue that you have mentioned is not related to the fix rollout. We did not observe this on our multiple tests. If you're still facing/observing this issue, please let us know, we'll follow-up with you offline. Thanks again for sharing those observations and your feedback.
//@Grmacjon-MSFT

giovanni.fleres 6 Reputation points

2021-06-23T10:42:03.427+00:00

@Grmacjon-MSFT
Today we tried to deploy a new Web App and its managed certificate that in its domain name contains a “-“.
We got below error

Error: Error creating/updating App Service Managed Certificate "xxxxx" (Resource Group "xxxx"): web.CertificatesClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadRequest" Message="Properties.CanonicalName is invalid.

We retried to do it manually from Azure Portal an it work.
This Web App has been deployed in the West Europe region
Any clues ?

Thanks

GF

CB-Elite 11 Reputation points

2021-06-23T11:58:54.127+00:00

For anyone waiting on UK South, I can confirm this is fixed now. We created our certificate today. Thanks @Grmacjon-MSFT for keeping us all updated

Grmacjon-MSFT 18,451 Reputation points

2021-06-23T19:40:36.773+00:00

Thanks for confirming, @CB-Elite !

Grmacjon-MSFT 18,451 Reputation points

2021-06-23T19:52:39.697+00:00

Hi @giovanni.fleres ,

So sorry to hear you are still having trouble creating a cert. We will need to do a deeper investigation to find out what is causing that error.

please reach out to us offline at azcommunity@microsoft.com with the subject "ATTN: Grace" and in the body of the email include your Azure Subscription ID, app name, domain name & time when you tried the operation (in UTC) & the link to this thread.

Thanks,
Grace

Grmacjon-MSFT 18,451 Reputation points

2021-06-30T19:14:36.887+00:00

Hi @giovanni.fleres ,

Checking to see if you are still facing this issue. We haven't received an email from you yet. We look forward to hearing from you soon.

Best,
Grace

giovanni.fleres 6 Reputation points

2021-07-01T07:59:31.877+00:00

Hi @Grmacjon-MSFT ,
After that incident, we deployed others Web Apps in the West Europe region with a "-" in their domain name and so far no issues.

Thanks
Kind Regards
Giovanni

Grmacjon-MSFT 18,451 Reputation points

2021-07-01T19:26:03.327+00:00

Thanks for the update @giovanni.fleres !
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Digital Dividend AB 6 Reputation points

2021-09-01T14:07:58.2+00:00

Hello,

We are having the similar issue with App Service Managed Certificate creation. Attached snapshot as well for the error. Reason might be due to swedish characters in domain. Location is North Europe.

Any help in this regard will be appreciated
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Florian Dürrbaum 6 Reputation points

2024-02-28T10:45:06.9666667+00:00

This issue is not resolved. Facing it in West EU with German "Umlaut" in First-Level-Domain-Name, which is valid:
Please sign in to rate this answer.

1 person found this answer helpful.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Laura Tams 0 Reputation points

2024-06-11T15:11:41.7666667+00:00

I concur. Issue is not resolved. Or has reoccurred.
I am currently experiencing issues with the exact same behavior as Mr. Rand describes in original post. With validation of my domain succeeding in the "Add binding" wizard from the portal, showing a green tick and message, then throwing an error: "Properties.CanonicalName is invalid.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Yashvit Naik 26 Reputation points

2021-10-14T06:36:24.31+00:00

This issue is still not resolved!! I am facing this even today in West EU.

The domain I am using is with a dash in the url:
xxxxx-yyyyy.xyz.com
Please sign in to rate this answer.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Cannot create App Service Managed Certificate with error "Only letters and numbers are allowed"

5 additional answers

Your answer