Unable to Assign Azure Managed Wildcard Domain to App Service

Shaun Tonstad 35 Reputation points
2026-07-13T20:53:38.6+00:00

I have a managed wildcard certificate purchased from Azure. Example: *.contoso.com.

I am unable to add new subdomains to App Services using this wildcard certificate. For example, I would like to add foo.contoso.com to an existing app service. When I select App Service -> Custom Domains -> Add Custom Domain, I see options to purchase a new certificate or import an existing certificate. Alternatively, if I select App Service Managed Certificate, the existing wildcard certificate is not displayed in the drop-down.

How do I create a new subdomain using an existing Azure managed wildcard certificate and assign it to an app service through the Azure portal user interface?

Thanks,

Shaun

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

Answer accepted by question author
Christos Panagiotidis 3,551 Reputation points
2026-07-14T07:02:03.3466667+00:00

Hi, the naming is confusing here: an App Service Managed Certificate is a free certificate created for a specific hostname, while an App Service Certificate you purchased is a separate Key Vault-backed resource and can be wildcard. Add and validate foo.contoso.com as a custom domain on the app first. Then import/sync the purchased certificate into the App Service TLS/SSL certificates area and create an SNI binding for that hostname. You do not select a purchased wildcard certificate from the Managed Certificate workflow. Also confirm the certificate secret is accessible, current, and covers *.contoso.com; the wildcard does not cover the apex contoso.com itself.

Was this answer helpful?

2 people found this answer helpful.
0 comments

3 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Praneeth Maddali 12,670 Reputation points Microsoft External Staff Moderator
    2026-07-15T01:08:10.13+00:00

    Hi @Shaun Tonstad

    Thanks for the positive response and for sharing the update. I also appreciate your confirmation by email.

     

    Thanks for reaching out with the details on your managed wildcard certificate. I understand you're trying to add a new subdomain like foo.contoso.com to your App Service but aren't seeing the wildcard certificate in the free managed certificate dropdown — this is expected, as free App Service managed certificates don't support wildcards.

    Here's the recommended way to get this working:

    1. Import the certificate into your App Service (if not already done): Go to your App Service >Certificates (or TLS/SSL settings) > Bring your own certificates (.pfx) > Add certificate > Import App Service Certificate. Select StellarConquestWildcard-2025, validate, and add it.
    2. Add the subdomain: In Custom domains > + Add custom domain, choose All other domain services, enter foo.contoso.com, and select Add certificate later.
    3. Bind the wildcard certificate: Once the domain is verified (via the required CNAME record), select Add binding next to the new domain, choose your imported wildcard certificate, use SNI SSL, and save.

    This should allow any subdomain matching *.contoso.com to use the existing certificate.

    Reference :

    https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2Crbac%2Cazure-cli

    https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-bindings

    https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain?tabs=root%2Cazurecli

    User's image

    User's image

    If the answer is helpful,  Please do click "Accept the answer” and Yes, this can be beneficial to other community members.

    If you have any other questions, let me know in the "comments" and I would be happy to help you

    Was this answer helpful?

    0 comments
  2. Abhinaba Das 115 Reputation points Microsoft External Staff Moderator
    2026-07-13T21:51:27.8566667+00:00

    Hi @Shaun Tonstad

    Thanks for reaching out with the issue of Wildcard Certificate is not showing while creating subdomain.

    An App Service Managed Certificate and a purchased App Service Certificate are two different certificate options. A Managed Certificate is free, created for an individual custom hostname, and does not support wildcard certificates. A purchased App Service Certificate is a separate certificate resource, stored and managed through Azure Key Vault, and can support wildcard domains.

    For foo.contoso.com, you can configure it as follows:

    1. Add and validate foo.contoso.com under the App Service Custom domains page.
    2. Under Certificates, select Bring your own certificates (.pfx) > Add certificate.
    3. For Source, select Import App Service Certificate, and then select the purchased *.contoso.com certificate.
    4. After the certificate is imported, select Add binding next to foo.contoso.com.
    5. Select the imported certificate, choose SNI SSL, validate it, and add the binding.

    A purchased wildcard certificate is not selected through the App Service Managed Certificate creation workflow. Please also confirm that the certificate is current, accessible through Key Vault, and contains *.contoso.com in its covered names. A wildcard name such as *.contoso.com does not, by itself, cover the apex domain contoso.com unless the apex domain is separately included in the certificate.

    References:

    If the answer is helpful, please do click "Accept the answer” and Yes, this can be beneficial to other community members.

    Was this answer helpful?

    0 comments
  3. TP 163.5K Reputation points Volunteer Moderator
    2026-07-13T21:14:19.49+00:00

    Hi Shaun,

    When adding custom subdomain, please choose Add certificate later option, create necessary asuid.subdomainx TXT record, validate, etc. Once that is finished click Add binding and select your purchased wildcard App Service Certificate.

    NOTE: The above assumes you already have imported your App Service certificate. If you haven't imported it please navigate to Certificates blade -- Bring your own certificates (*.pfx) tab, click Add certificate, for Source select Import App Service Certificate, select your certificate, Add.

    Please click Accept Answer and upvote if the above was helpful.

    Thanks.

    -TP

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.