Failed to update domain secret to BYOC.

Question

I was updating the secret for the custom domain in Azure Front Door to use "Bring your own certificate", it worked for me before, it failed recently for all my changes showing the error as below. Anyone has any idea why this is happening and how I can fix it?

Answer 1

Hi @Enyu Wang,

Thank you for reaching out on Microsoft Q&A forum.

As mentioned by the user, the root cause was identified as a limitation in Azure Front Door Control Plane (AFD CP). For keyless customers whose profiles were migrated from 1P to 3P AFD, only 100 custom domains can reference the same SHA-1 certificate thumbprint.

Once this limit is reached, BYOC updates fail for additional domains, which explains the error encountered.

Resolution / Workaround: As suggested by the user, the fix is to create a duplicate copy of the certificate/secret in Key Vault and use the duplicated secret for the new domains. The user is coordinating with the security team to implement this.

This workaround successfully bypasses the thumbprint reference limitation.