Artifact Signing: sign operation returns "Failed" (null signature) and certificate issuance is broken after subscription was disabled/reactivated

Question

Summary

After my Azure subscription was briefly disabled for a billing issue and then reactivated, my Artifact Signing (Trusted Signing) account can no longer sign. Authentication succeeds, but every sign operation resolves to status "Failed" with a null signature and null errorResponse, and the account has stopped issuing certificates entirely. Everything visible in ARM and the portal looks healthy. This looks like a service-side hold on the account that I can't see or clear myself. I'm on a plan without technical support, so posting here.

Timeline

• ~late May 2026: subscription Disabled (failed payment). Certificate issuance stopped (last daily cert minted ~end of May).
• 2026-06-08: subscription reactivated (now Enabled, spending limit Off).
• Since reactivation: signing fails continuously (details below).

Symptoms

1. POST .../certificateprofiles/modmixer-release:sign returns 202 Accepted, then the operation resolves to: { "status": "Failed", "signature": null, "errorResponse": null } No error detail is returned to the caller.
2. Reproduced two independent ways — both Fail identically: - CI via @electron/windows-sign + Azure CodeSigning dlib (OIDC service principal) - Direct REST calls (user identity with Artifact Signing Certificate Profile Signer role), api-version 2024-06-15 and 2023-06-15-preview
3. A fresh certificate was auto-minted 2026-06-08 17:03 UTC (status Active), but signing kept failing with it for ~18h, and no new cert was minted the next day (daily rotation did not occur).
4. I created a NEW certificate profile bound to the same identityValidationId as a test — it reached provisioningState "Failed" and never issued any certificate. So certificate issuance is broken at the account level, not the profile.
5. I revoked the one Active cert to force a re-issue. Result: zero Active certs, sign now returns 403, and NO replacement certificate is being minted.

What I've verified is healthy

• Subscription Enabled, Pay-As-You-Go, spending limit Off
• Resource provider Microsoft.CodeSigning: Registered
• Account provisioningState: Succeeded
• Certificate profile: status Active, PublicTrust, bound to a valid identity validation
• Identity validation: Completed (and account is only ~5 weeks old, so not expired)
• Signing identity has the Artifact Signing Certificate Profile Signer role
• No active Azure Service Health / Resource Health events
• SignCompleted metric: ~0 successful signs since reactivation

Question

Reactivating the subscription cleared the auth (403 -> 202), but the account still can't issue certificates or complete sign operations. Is there a service-side hold on this account left over from the disabled-subscription period, and how do I get it released? Anything I can do on my side, or does this require the Artifact Signing team to reset the account state?

Answer 1

Third report of exactly this, and the sequence matches yours step for step.

Subscription was disabled over a billing issue, then reactivated. Sign

requests were returning a bare 403 with no body until I accepted the

renewed terms (the notice only appears as a banner on the Identity

validation page in the portal, nothing about it is visible over the API).

After accepting, the service went from 403 to 2xx, and every sign

operation since then resolves to {"status":"Failed","signature":null,

"errorResponse":null}.

I ruled out my own toolchain: I bypassed signtool and the Azure dlib

entirely and called the signing endpoint over plain HTTPS with a bearer

token and 32 bytes of digest made up on the spot, no file involved.

HTTP 202 with an operationId, then Failed with a null signature two

seconds later. The service never sees my build, my runner or my binary,

and it still fails.

Everything else measures healthy with the same service principal that

fails: subscription Enabled, account Succeeded, profile Active, identity

validation Completed, role assigned at account scope, and certificates

are being issued again daily. The exact workflow signed fine on

2026-08-12.

I filed a support request and it was closed as out of scope for the Basic

plan. So this needs someone from the Artifact Signing team, same as in

learn.microsoft.com/en-us/answers/questions/5859082/ where it was fixed

by hand on the service side.

Answer 2

Yeah, what's the deal here Microsoft? Same problem and it caused me to miss a crucial deadline today..