Add TLS/SSL binding fails to validate after correctly setting up the custom domain

Question

Add TLS/SSL binding fails to validate after correctly setting up the custom domain

TAL 5

The DNS records have been set based on the instructions and the A records have been removed based on this: https://learn.microsoft.com/en-us/answers/questions/5852936/app-service-managed-certificate-creation-fails-whe (which also says the only way to fix this is through support or getting an outside certificate).

The error is:

Hostname not eligible for App Service Managed Certificates creation. Ensure that your domain has an active CNAME record which is set to...

kagiyama yutaka 5,655 Reputation points

2026-09-22T09:33:24.0333333+00:00

Could you also add whether this is an apex or subdomain, the current DNS records, and whether domain validation succeeds? Might help narrow down where it’s failing.
TAL 5 Reputation points

2026-09-22T10:04:27.5+00:00

This is for the www root domain. I was first instructed to add two "A" DNS records with IP addresses and a TXT record for an asuid code and the domain was verified.

Now I'm trying to bind the free TLS/SSL certificate and I was instructed to add a CNAME record with www as the host and a URL MS provided, which I did, but it wouldn't verify after waiting 24-hours. Then I read that I should delete the two "A" records that I had previously entered, so I did that, but still getting the same error. Thank you for asking!

3 answers

Your answer

kagiyama yutaka 5,655 Reputation points

2026-09-22T09:33:24.0333333+00:00

Could you also add whether this is an apex or subdomain, the current DNS records, and whether domain validation succeeds? Might help narrow down where it’s failing.
TAL 5 Reputation points

2026-09-22T10:04:27.5+00:00

This is for the www root domain. I was first instructed to add two "A" DNS records with IP addresses and a TXT record for an asuid code and the domain was verified.

Now I'm trying to bind the free TLS/SSL certificate and I was instructed to add a CNAME record with www as the host and a URL MS provided, which I did, but it wouldn't verify after waiting 24-hours. Then I read that I should delete the two "A" records that I had previously entered, so I did that, but still getting the same error. Thank you for asking!

Answer 1

TAL 5

This is resolved. I'm not sure what happened, but I deleted a few older DNS entries and then it worked after about an hour.

kagiyama yutaka 5,655 Reputation points

2026-09-22T12:03:58.6333333+00:00

Glad you got it working. It sounds like one of those older DNS records may have been getting in the way. Thanks for sharing the update.

Answer 2

kagiyama yutaka 5,655

I think the CNAME for www is the part to check now. ASMC requires it to map directly to the app’s .azurewebsites.net hostname, and an intermediate CNAME blocks issuance and renewal.

Check the public CNAME response, then retry Certificates → Managed certificates → Add certificate → Validate. If it already matches and validation still fails, the DNS record alone does not identify the cause. At that point, contact Azure Support.

0 comments

Answer 3

For this specific App Service Managed Certificate error, the supported fixes in the available guidance are:

Confirm the hostname is added and validated first In Azure portal, go to App Service > Custom domains > Add custom domain. Enter the hostname and select Validate. The expected result is green checkmarks for the hostname record and TXT record before adding the domain.
Verify DNS is using the correct record pattern
- For a subdomain, use a CNAME to *.azurewebsites.net.
- For a root/apex domain, use an A record to the app IP plus the TXT asuid verification record.
- Do not keep conflicting records for the same name.
Allow for DNS propagation and Azure-side validation delay Even when public lookup tools resolve correctly, Azure validation can still fail because of TTL or cached negative DNS responses. The documented guidance is to wait and retry later. This usually resolves within two hours, and DNS propagation can take up to 48 hours worldwide.
If App Service Managed Certificate is not allowed for the hostname, use a custom certificate instead The documented limitation is that the free ASMC method does not issue certificates for wildcards or certain domain types. In that case, use a certificate from a trusted certificate authority.
Upload or import a certificate and bind it manually
- Upload PFX: App Service > TLS/SSL Settings > Private Key Certificates (.pfx), then upload the certificate.
- Then go to Custom domains > Add binding and select the uploaded certificate.
- Use SNI SSL for most scenarios.
- IP-based SSL is needed only for older clients that do not support SNI, and IP SSL requires Standard tier or greater.
If the domain is still associated with another Azure resource, remove that conflict A domain can be linked to only one App Service-related Azure resource at a time. If it was previously bound elsewhere and cannot be removed because the old resource is inaccessible, Azure support is the documented path to release the domain.
Check for binding conflicts if certificate binding fails after validation If Azure reports hostname conflicts or SSL binding conflicts, remove old bindings first. Also avoid duplicate IP-based bindings.

The accepted Q&A case matching this exact error states the issue was caused by a backend service path problem and was resolved by Microsoft on the service side. There is no documented self-service cache refresh for that condition. When DNS is correct, the hostname validates, and managed certificate creation still returns "Hostname not eligible for App Service Managed Certificates creation", the supported workaround in the available guidance is to use a trusted custom certificate, or use Azure support if the hostname/domain association is stuck.