Function App - Get Certificates task running for much longer than stated 10 minutes

Question

We had an SSL Certificate expire for our Web Api Function App in Azure. The solution stated by the system was to delete and recreate the certificate. I have deleted the certificate and gone through the process of generating a new one. During the process, it mentioned it might take up to 10 minutes for the App Service Managed Certificate to be available.

It's been over an hour, and our Activity Log just keeps adding "Get Certificates" logs every ~20 minutes or so.

I haven't received any errors, and it still seems that it might be in the process of generating. In the meantime our client's site is down. Is there anything I can do to troubleshoot?

Answer 1

Hi @Application Account

Thank you for reaching out to Microsoft Q&A.

When creating an App Service Managed Certificate for an Azure Function App, the certificate issuance process depends on successful domain validation by the Certificate Authority (DigiCert). Although the Azure portal mentions that the process may take up to 10 minutes, scenarios where the Activity Log repeatedly shows “Get Certificates” without any failure usually indicate that the backend certificate workflow is stuck. In this state, Azure keeps retrying the certificate retrieval operation, but the certificate will not be issued unless the underlying validation completes successfully. This can occur due to DNS propagation issues, missing or restrictive CAA records, or App Service infrastructure-related problems. Unfortunately, the portal may not surface any explicit error, which makes it appear as if the process is still running, even though it will not complete without corrective action.

Refer below points to resolve this issue or as a workaround:

Verify DigiCert Domain Validation Token After initiating the managed certificate creation, Azure attempts to expose a temporary validation file required by DigiCert. You can manually verify this by browsing to:

https://<your-custom-domain>/.well-known/pki-validation/fileauth.txt

If the token never appears after several minutes, it indicates that domain validation is not progressing and the certificate request is unlikely to complete successfully. In such cases, waiting longer will not help.

Check DNS Configuration and CAA Records Ensure that all required DNS records are correctly configured and publicly resolvable:

• The custom domain must correctly resolve to <appname>.azurewebsites.net.
• The TXT record asuid.<hostname> must exist with the correct value for domain ownership validation.
• If your domain uses CAA records, you must explicitly allow DigiCert to issue certificates by adding the following record:

CAA 0 issue "digicert.com"

Missing or restrictive CAA records are a common reason for managed certificate creation getting stuck.

Restart or “Kick” the App Service Infrastructure In some cases, the issue is related to the underlying App Service infrastructure rather than configuration. A practical workaround is to:

• Scale the App Service Plan up or down (for example, from B1 to B2 and back), or
• Move the Function App to a new App Service Plan and reconfigure the custom domain and managed certificate. This forces Azure to reprovision the backend resources and often allows the certificate process to complete successfully.

Apply a Temporary Certificate to Restore Service If the application is already down and immediate recovery is required, consider uploading and binding a temporary SSL certificate (for example, a privately issued or Let’s Encrypt certificate). This restores HTTPS access for clients while you continue troubleshooting or retry managed certificate creation later.Thank you for reaching out to Microsoft Q&A.

When creating an App Service Managed Certificate for an Azure Function App, the certificate issuance process depends on successful domain validation by the Certificate Authority (DigiCert). Although the Azure portal mentions that the process may take up to 10 minutes, scenarios where the Activity Log repeatedly shows “Get Certificates” without any failure usually indicate that the backend certificate workflow is stuck. In this state, Azure keeps retrying the certificate retrieval operation, but the certificate will not be issued unless the underlying validation completes successfully. This can occur due to DNS propagation issues, missing or restrictive CAA records, or App Service infrastructure-related problems. Unfortunately, the portal may not surface any explicit error, which makes it appear as if the process is still running, even though it will not complete without corrective action.

Refer below points to resolve this issue or as a workaround:

Verify DigiCert Domain Validation Token
After initiating the managed certificate creation, Azure attempts to expose a temporary validation file required by DigiCert. You can manually verify this by browsing to:

https://<your-custom-domain>/.well-known/pki-validation/fileauth.txt

If the token never appears after several minutes, it indicates that domain validation is not progressing and the certificate request is unlikely to complete successfully. In such cases, waiting longer will not help.

Check DNS Configuration and CAA Records
Ensure that all required DNS records are correctly configured and publicly resolvable:

• The custom domain must correctly resolve to <appname>.azurewebsites.net.
• The TXT record asuid.<hostname> must exist with the correct value for domain ownership validation.
• If your domain uses CAA records, you must explicitly allow DigiCert to issue certificates by adding the following record:

CAA 0 issue "digicert.com"

Missing or restrictive CAA records are a common reason for managed certificate creation getting stuck.

Restart or “Kick” the App Service Infrastructure
In some cases, the issue is related to the underlying App Service infrastructure rather than configuration. A practical workaround is to:

• Scale the App Service Plan up or down (for example, from B1 to B2 and back), or
• Move the Function App to a new App Service Plan and reconfigure the custom domain and managed certificate.
  This forces Azure to reprovision the backend resources and often allows the certificate process to complete successfully.

Apply a Temporary Certificate to Restore Service
If the application is already down and immediate recovery is required, consider uploading and binding a temporary SSL certificate (for example, a privately issued or Let’s Encrypt certificate). This restores HTTPS access for clients while you continue troubleshooting or retry managed certificate creation later. If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know.