Pending managed certificate failed: Pending certificate expired. Please try again

I have run into this before when the domain was validated but the DNS TXT or CNAME record hadn’t fully propagated, so the certificate request sat in “Pending” until it expired. App Service doesn’t retry automatically once it hits that state.

Hii @Dipesh,

Thank you for reaching us regarding the issue. It looks like you’re having trouble adding a managed certificate to your containerized app. The error message, ‘Pending managed certificate failed: Pending certificate expired,’ can definitely be frustrating.

Verify DNS Records:

Even with domain validation succeeding, issuance can fail if records aren't fully propagated or exact.

• Sign in to your DNS provider’s management console (e.g., GoDaddy, Cloudflare).

Ensure the exact DNS records specified in the Azure portal exist:

• Root domain: A record pointing to the App Service's external IP.
• Subdomains: CNAME record pointing to <yourapp>.azurewebsites.net.

Clean Up Expired/Pending Certificates and Retry:
The "expired" state often leaves blocking resources. Remove them to allow a fresh request.

1. In Azure Portal:
   • Go to your App Service > TLS/SSL settings > Certificates.
   • Delete any certificates in "Pending" or "Failed" state for your domain.
   • Navigate to Custom domains > Remove the custom domain binding.
   • Check Monitoring > Activity log for the failed operation:
   • Filter by "Add or Update Certificate" > View details (look for timeouts, CA rejections, or validation errors).
   • Re-add the custom domain and attempt to create the managed certificate again.
2. By Azure CLI, we can check clear pending certificates:
   Use Azure CLI to check for pending certificates:

az webapp config ssl list --resource-group <ResourceGroup> --name <AppServiceName>

If a pending certificate exists, delete it:

az webapp config ssl delete --certificate-thumbprint <Thumbprint> --resource-group <ResourceGroup> --name <AppServiceName>

Then attempt to re-create the Managed Certificate:

az webapp config ssl create --resource-group <ResourceGroup> --name <AppServiceName> --hostname <CustomDomain>

Monitor status:

az webapp config ssl show --resource-group <ResourceGroup> --name <AppServiceName> --hostname <CustomDomain>

Reference:
https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-azure-app-service-certificates
Kindly let us know if the above comment helps or you need further assistance on this issue. Please "upvote" if the information helped you. This will help us and others in the community as well.