Unable to set custom domain on API gateway (consumption tier): BadRequest on unvalid CNAME, when it's correct

Question

Unable to set custom domain on API gateway (consumption tier): BadRequest on unvalid CNAME, when it's correct

Andrew Connell 141 MVP

Trying to set the custom domain on two Azure API Management resources... both (1) are the only API Management resources in their respective subscription & (2) both are on the consumption tiers. The actual endpoints & operations are working, just unable to set the custom domain.

Using the Azure Portal, selecting the API Management resource, I then selected Custom Domains and select Add & set the following values:

Type: Gateway
Hostname: api.v[...]s.io
Certificate: Managed (preview)

I then added the two DNS records (TXT & CNAME) to my DNS records (hosted in Cloudflare), waited until they were resolving & verified they propagated with a few DNS tools:

Back in the portal, I select ADD and SAVE, but I keep getting an error: BadRequest: CNAME record pointing from api.v[..]s.io to apiv[..]sio.azure-api.net was not found..

These records were added 10+ hours ago and have shown to have been propagated for a while, but I keep getting this error. After multiple attempts and waiting hours on both resources, I'm at a loss.

The only thing I can think of: these custom domains were previously attached to an Azure Functions resource, but I deleted them prior to adding them to the API Management resources. ... is Azure internally caching those original CNAME DNS entries that pointed to the Azure Function resource previously (and thus, the CNAME pointer was different), and even though they've been updated, Azure hasn't updated its internal DNS?

Andrew Connell 141 Reputation points MVP

2022-05-30T22:02:19.423+00:00

Following up... now seeing something strange. When I ping my original APIM resource hostname & my custom domain, they both resolve to the same IP, but when I look at the APIM custom domains page, I don't see my custom domain listed.

But... when I request one of the endpoints, I get a cert error: NET::ERR_CERT_COMMON_NAME_INVALID

It's like the cert that Azure is trying to use isn't valid... still, could this be a caching issue? The cert doesn't expire for another 12mo... so is it even possible to force the purge of the cert?
JananiRamesh-MSFT 29,251 Reputation points

2022-06-01T10:22:18.283+00:00

Hi @Andrew Connell

Error message: A TXT record pointing from asuid.api.voitanos.io to 7a0573f1f669f3fb9cc3841debdf60e21fd8f24352fa98c31d35db9dc126afb5 was not found.

As the Error message indicates can you please add this TXT record asuid.api.voitanos.io to 7a0573f1f669f3fb9cc3841debdf60e21fd8f24352fa98c31d35db9dc126afb5 and please remove the subdomain
apimuid.api.voitanos.io PHKq02vMlW61E+GAt4RxibVN2kBFhnfIruJuK+BXZT0= and retry adding the Custom domain and let me have your feedback.
Andrew Connell 141 Reputation points MVP

2022-06-01T10:29:32.487+00:00

I removed the apimuid.api.voitanos.io TXT record and added the asuid.api.voitanos.io TXT record as you requested. That didn't work... in-fact it failed immediately stating I was missing the apimuid.api.voitanos.io record:

So, I followed the instructions in the error message & added the apimuid.api.voitanos.io TXT record back with the string PHKq02vMlW61E+GAt4RxibVN2kBFhnfIruJuK+BXZT0= & tried again, but this time it worked.

I'm confused... you said to do the inverse (remove the apimuid.api TXT record & add the asuid.api TXT record) of what the instructions in the Azure portal say to do (add the apimuid.api TXT record... no mention of the asuid.api record). When I followed the instructions, it worked as expected... but why wasn't it working before?
Andrew Connell 141 Reputation points MVP

2022-06-01T10:43:49.907+00:00
Furthermore, I'm having the exact same problem with the other APIM resource/domain/subscription I listed in my initial reply to you above:

subid = <<removed>>

resourcename = apiandrewconnellcom

attempting to map api.andrewconnell.com to apiandrewconnellcom.azure-api.net via CNAME using the Managed certificate option

I tried following the same process, but it's not working... having the exact same issue. Even though I've followed the same instructions and set the same values, the portal specified. I have the apimuid.api.andrewconnell.com TXT record set to v8r5IOvuOkZFXRxpLG6e8SzaSMDR3mnJ2BE+oO0C82I= just as the error message says.

Its like the instructions in the portal aren't correct, are incomplete, or something else is happening on the backend that's not clear...

Accepted answer

1 additional answer

Your answer

Andrew Connell 141 Reputation points MVP

2022-05-30T22:02:19.423+00:00

Following up... now seeing something strange. When I ping my original APIM resource hostname & my custom domain, they both resolve to the same IP, but when I look at the APIM custom domains page, I don't see my custom domain listed.

But... when I request one of the endpoints, I get a cert error: NET::ERR_CERT_COMMON_NAME_INVALID

It's like the cert that Azure is trying to use isn't valid... still, could this be a caching issue? The cert doesn't expire for another 12mo... so is it even possible to force the purge of the cert?
JananiRamesh-MSFT 29,251 Reputation points

2022-06-01T10:22:18.283+00:00

Hi @Andrew Connell

Error message: A TXT record pointing from asuid.api.voitanos.io to 7a0573f1f669f3fb9cc3841debdf60e21fd8f24352fa98c31d35db9dc126afb5 was not found.

As the Error message indicates can you please add this TXT record asuid.api.voitanos.io to 7a0573f1f669f3fb9cc3841debdf60e21fd8f24352fa98c31d35db9dc126afb5 and please remove the subdomain
apimuid.api.voitanos.io PHKq02vMlW61E+GAt4RxibVN2kBFhnfIruJuK+BXZT0= and retry adding the Custom domain and let me have your feedback.
Andrew Connell 141 Reputation points MVP

2022-06-01T10:29:32.487+00:00

I removed the apimuid.api.voitanos.io TXT record and added the asuid.api.voitanos.io TXT record as you requested. That didn't work... in-fact it failed immediately stating I was missing the apimuid.api.voitanos.io record:

So, I followed the instructions in the error message & added the apimuid.api.voitanos.io TXT record back with the string PHKq02vMlW61E+GAt4RxibVN2kBFhnfIruJuK+BXZT0= & tried again, but this time it worked.

I'm confused... you said to do the inverse (remove the apimuid.api TXT record & add the asuid.api TXT record) of what the instructions in the Azure portal say to do (add the apimuid.api TXT record... no mention of the asuid.api record). When I followed the instructions, it worked as expected... but why wasn't it working before?
Andrew Connell 141 Reputation points MVP

2022-06-01T10:43:49.907+00:00

Furthermore, I'm having the exact same problem with the other APIM resource/domain/subscription I listed in my initial reply to you above:

subid = <<removed>>

resourcename = apiandrewconnellcom

attempting to map api.andrewconnell.com to apiandrewconnellcom.azure-api.net via CNAME using the Managed certificate option

I tried following the same process, but it's not working... having the exact same issue. Even though I've followed the same instructions and set the same values, the portal specified. I have the apimuid.api.andrewconnell.com TXT record set to v8r5IOvuOkZFXRxpLG6e8SzaSMDR3mnJ2BE+oO0C82I= just as the error message says.

Its like the instructions in the portal aren't correct, are incomplete, or something else is happening on the backend that's not clear...

Answer 1

@Andrew Connell As of now to create a Custom domain for an APIM instance deployed in Consumption sku requires all the following values and use them to configure DNS

CNAME record
TXT record
apimuid.[customdomain] TXT set to the value specified in the portal
asuid.[customdomain] TXT which you don't get from the portal to get this value either you should create a support ticket or reach out to us in Q&A forum.

Work item has been created and fix will be deployed soon. we will update the documentation to add additional steps for Consumption SKU.

Do let me know if you have any queries.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

Answer 2

We had been faced with the same issue for 15 hours.

Here is my story.

There was CNAME record point to another host.
There are TXT record required by API Management.
I changed the CNAME record to point to API Management gateway.
I save the custom domain.
API Management says CNAME record not found.

Is this TTL problem? I think NO. I changed TTL of the CNAME record to 5 minutes 2 days ago.

Now, I resolve it. How to is following.

Update the CNAME record required by API Management.
Create a TXT record required by API Management.
Configure Custom domain, and hit [Save] button.
Delete the CNAME record. (Not kidding you)
After a while, Custom domain (hostnameConfigurations) is saved successfully.
Re-create the CNAME record.

Have a nice weekend! Thanks!

Share via

Unable to set custom domain on API gateway (consumption tier): BadRequest on unvalid CNAME, when it's correct

1 additional answer

Your answer