Production outage due to missing TLS binding for custom domain managed by Azure

Question

We are using an Azure-managed certificate for a custom domain.

At one point this morning, the domain began serving the default Azure App Service certificate instead of the expected TLS certificate, and this persisted throughout the day until we manually uploaded and bound our own certificate.

We confirmed using:

openssl s_client -connect <custom-domain>:443 -servername <custom-domain>

The certificate returned had:

• CN: *.azurewebsites.net
• SAN: only Azure default domains (our custom domain was not included)

This suggests the custom domain was no longer associated with the expected TLS/SSL certificate, and Azure served the default platform certificate instead.

Additional context:

• DNS for the custom domain was unchanged
• The custom domain remained configured
• No intentional changes were made to TLS/SSL settings prior to the issue
• The issue was resolved only after replacing the managed certificate with a manually uploaded certificate

We’re looking to understand what may have caused this behavior with the Azure-managed certificate and how to avoid it going forward. Any logs or insights into certificate rotation or binding behavior would be helpful.

Thanks in advance for your help.

Answer 1

Hello Matthew Cabral,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having production outage due to missing TLS binding for custom domain managed by Azure.

The outage was caused by loss or corruption of TLS binding between the custom domain and Azure-managed certificate, likely due to platform-side sync failure or internal service issue, NOT renewal failure. Since your cert is not yet expired till April, the below steps can help you fix the issue:

1. Enforce binding integrity monitoring by monitor Azure Activity Logs: `Microsoft.Web/sites/hostNameBindings/write` `Microsoft.Web/certificates/write` `sslBindings/write` Detects unexpected binding changes.
2. Implement synthetic TLS monitoring by run continuous checks using bash command: openssl s_client -connect domain:443 -servername domain Alert if: CN != expected domain
3. Add automatic recovery script or automation. Check binding if missing > rebind certificate. Use this bash az webapp config ssl bind This directly addresses failure mode.- [ https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-azure-app-service-certificates]
4. Avoid sole dependence on Managed Certificates the recommended for production is to use: Azure Key Vault + custom cert OR External CA + manual upload. Because, managed certs have no SLA for binding continuity.
5. Force periodic certificate to sync by using this bash command: Rekey and Sync > Sync This will help fixes stale or broken bindings. - https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/connection-issues-with-ssl-or-tls/troubleshoot-domain-and-tls-ssl-certificates
6. Enable Azure Alerts on:
   • Certificate nearing expiry
   • Binding changes
   • App Service configuration changes
7. If the issue persist escalate to official Microsoft support by raising ticket. You can request:
   • RCA (Root Cause Analysis)
   • Incident ID

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.