Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
Managed Certificate is at risk of revocation
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 95%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERS%3C/text%3E%3C/svg%3E)
Raymond Starkey
25
Reputation points
On 9 Oct 2025 Microsoft sent me this notification...
These certificates were issued using a verification method recently flagged by Chrome and DigiCert. Azure attempted to renew them using DigiCert's updated validation method (effective 15 July 2025), but renewal failed due to:
• Missing or incorrect DNS records
• Certificate not actively bound to an app
• Other misconfigurations
This issue originates from DigiCert's process and is outside of Azure's control. If revocation proceeds, you will only have 24 hours' notice before the certificate is invalidated.
What this means for you
• Your certificate will not auto-renew unless validation issues are resolved.
• If revocation occurs, service disruption may happen within 24 hours of revocation. Refer to our documentation for more information.
I called GoDaddy, and they checked my DNS registration and reported that it was OK. They suggested that I contact you to see exactly what the problem is and how I can fix it.
Can you help please?
Thanks, Ray Starkey
Azure App Service
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 86%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVL%3C/text%3E%3C/svg%3E)
Vimal Lalani 1,735 Reputation points Microsoft External Staff Moderator2025-10-17T07:19:54.22+00:00 Hi @Raymond Starkey
Thank you for reaching out to the Microsoft Q&A community.
Azure App Service Managed Certificates (ASMC) issuance and renewal require public HTTP token validation, as DigiCert has updated its domain verification process.
If your App Service is not publicly accessible—for example, restricted by IP address, private endpoints, client certificates, or disabled public access—DigiCert cannot reach the validation endpoint, and the certificate issuance or renewal will fail.
Other restrictive configurations, such as Web Application Firewall (WAF) rules or custom access policies, can also block validation attempts. Certificates affected by these conditions will no longer auto-renew after the updated validation method took effect.
Please verify the following:
- The managed certificate is actively bound to an App Service custom domain.
- The App Service is publicly accessible (temporarily, if needed) so DigiCert can perform validation.
- No firewall, access restriction, or IP filtering is blocking DigiCert’s access.
Once validation succeeds, Azure should be able to renew the managed certificate automatically.
For detailed guidance, please refer to the official documentation: Renewal requirements for App Service Managed Certificates (ASMC)
Feel free to post back if you still encounter issues after verifying these settings.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 55.00000000000001%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERS%3C/text%3E%3C/svg%3E)
Raymond Starkey 20 Reputation points2025-10-18T06:03:55.3466667+00:00 You asked me to verify the following...
The managed certificate is actively bound to an App Service custom domain?
No, the domain is the one supplied by Azure when the web app was created (On the Azure site there is something called the App Service Certificate. Is this the same thing? If not, where is the managed certificate?)
The App Service is publicly accessible (temporarily, if needed) so DigiCert can perform validation?
No, it is not; the user has to be authenticated upon arrival. Temporarily, will require some effort on my part and a willingness to coordinate on the part of Digicert, i.e. agree on an access date.
No firewall, access restriction, or IP filtering is blocking DigiCert’s access.
None of these.
Ray Starkey, Developer
-
Vimal Lalani 1,735 Reputation points Microsoft External Staff Moderator
2025-10-23T09:40:16.31+00:00 Hi @Raymond Starkey
Just checking in, has your issue been resolved, or are you still experiencing it?
-
Raymond Starkey 20 Reputation points
2025-10-26T06:13:11.43+00:00 I have replied to your questions on Oct 18, 2025, 7:03 AM. Please answer. Can I also ask, as this app is published with this domain: https://rv2.azurewebsites.net, does this problem exist for me, as the certificate is surely issued to Microsoft?
Sign in to comment
Sign in to answer