Can't create Certificate

Question

Application: SundanceTransfer Resource Group: Sundance_Group Custom Domain: transfer.sundance-inc.net

Summary

An App Service Managed Certificate could not be successfully provisioned for the custom domain transfer.sundance-inc.net. Initial investigation revealed a previously failed certificate request that had expired in a pending state. Cleanup and reconfiguration steps were performed, but a subsequent certificate creation attempt remained in an accepted state without

Azure is accepting the certificate request but never progressing it far enough to create the actual certificate resource.

The evidence is:

• DNS is correct.
• Custom domain is attached.
• App is running.
• Certificate request is accepted.
• No certificate object appears.
• Endless certificate polling continues.

Tried

1. Deleted hostname.
2. Re-added hostname.
3. Deleted stale certificate.
4. Verified DNS.
5. Verified App Service configuration.

Answer 1

Hi @Jim Jackson

from teams chat we can confirm the issue is fixed

.From the deep investigation we found that the managed certificate creation is failing because of a CAA (Certification Authority Authorization) restriction on the domain. The records inherited from the parent domain sundance-inc.net currently authorize only trust-provider.com and ssl.com. Azure App Service Managed Certificates are issued by DigiCert, and DigiCert is not listed as an allowed issuer. As a result, the certificate request stays in a pending state until it expires, which produces the error you are seeing:

Pending managed certificate failed: Pending certificate expired.

This is called out directly in the diagnostics under “CAA Records – DigiCert Not Authorized.”

Recommended action

Please update the CAA records for sundance-inc.net (or at the transfer.sundance-inc.net level if your DNS provider supports it) to include DigiCert. The required record is:

0 issue "digicert.com"

You can keep the existing records for the other providers if they are still needed. After the change, allow time for DNS propagation (typically up to a few hours) and verify with a tool such as digwebinterface.com (query type CAA).

Once DigiCert is authorized:

1. Remove the custom domain transfer.sundance-inc.net from the App Service.
2. Wait 10–15 minutes.
3. Re-add the custom domain.
4. Create the App Service Managed Certificate again.

You may also want to confirm that the asuid.transfer.sundance-inc.net validation record is present, as one of the diagnostic checks flagged a missing ownership verification record.

Relevant Microsoft documentation:

• Create a free managed certificate (notes the DigiCert CAA requirement)
• App Service Managed Certificate changes (July 2025)
• Troubleshoot Azure App Service certificates

Please let us know once the CAA record has been updated and whether the certificate issues successfully after the retry. Happy to assist further if needed.

Answer 2

Thanks so much for the excellent support.