Unable to create Azure App Service Managed Certificate for Accented Domain

Question

Unable to create Azure App Service Managed Certificate for Accented Domain

Daniel Stout 11

I was able to add a custom domain containing the accented character "é", and when I go to App Service Managed Certificates it says "Hostname eligible for certificate creation. Click Create to create your App Service Managed Certificate." but after clicking Add it give this error:

Properties.CanonicalName is invalid. Canonical name [...] includes at least one special character. Only letters and numbers are allowed.

I would assume that means I'm supposed to use the punycoded version of the domain, but Azure won't let me add it to the app service - it keeps asking me to add the TXT and A records, even though I already added them (as evidenced by how I was able to add the accented version of the domain)

1 answer

Your answer

Answer 1

Ryan Hill 30,276 Microsoft Employee Moderator

Hi @Daniel Stout ,

Unfortunately, the use of accented characters isn't supported for App Service Managed Certs. Currently, there are no plans for supporting it. Main reason is because the use of accented characters will be rejected by DigiCert, so the CanonicalName invalid message is part of pre-validation step. To continue, you will have to use one of the other certificate options.

Daniel Stout 11 Reputation points

2021-10-06T13:34:51.297+00:00

It's fine that they don't accept accented characters - I should then be able to use the punycoded version of the domain that converts the accented characters into standard ASCII.

Why can't I add the punycode version of the domain? It acts as though I haven't added the TXT record. To clarify by punycode I mean the xn-- version of the domain: https://en.wikipedia.org/wiki/Internationalized_domain_name
Ryan Hill 30,276 Reputation points Microsoft Employee Moderator

2021-10-06T20:28:37+00:00

Punycode and IDNs aren't supported for custom hostnames which means App Service Managed Cert doesn't support them either. That's why you can't bind it. I know punycode domains can be purchased on Azure so this limitation is provider based, as managed certs are provided by DigiCert.
Sascha-Matthias Kulawik 0 Reputation points

2023-06-05T13:31:51.9066667+00:00

I would like to point out that xn- domains are standardized according to IDNA https://en.wikipedia.org/wiki/Internationalized_domain_name since 2008 and are therefore valid names and should also be supported by Microsoft.

I therefore ask you to forward this accordingly and to open a bug report for it.

Furthermore we could add a IDNA Domainvia the CLI interface using the

az webapp config hostname add
command, whereas this was not possible via the web interface.

We were able to help us by using a LetsEncrypt Cert Bot which was able to create a SSL Cert for a xn-- Domain.

Share via

Unable to create Azure App Service Managed Certificate for Accented Domain

1 answer

Your answer