Artifact Signing: all sign operations return Failed/null after subscription was disabled and reactivated

Raj Sahani 20 Reputation points
2026-07-18T05:57:12.9266667+00:00

Our Artifact Signing account cannot sign since our subscription was briefly disabled for a billing issue and then reactivated. The subscription is now Active, but signing never recovered.

Symptom: every sign operation is accepted (returns an operationId) but completes as

{"status":"Failed","signature":null,"signingCertificate":null}

with no errorResponse. Reproduced both via signtool + Azure.CodeSigning.Dlib 1.0.128 and via direct REST calls to the sign endpoint.

Details:

  • Account: mixar-signing, endpoint https://wus2.codesigning.azure.net/ (West US 2)
  • Certificate profile: mixar-public-release (Public Trust)
  • Subscription: PayAsYouGo, now Enabled (was Disabled ~2026-07-14 to 2026-07-17)

Everything on our side verifies as correct (checked via az CLI):

  • Subscription Enabled, PayAsYouGo, spending limit Off
  • Resource provider Microsoft.CodeSigning: Registered
  • Account provisioningState: Succeeded
  • Certificate profile status: Active, and it currently holds a valid, non-expired certificate (issued 2026-07-17 15:26 UTC, expiry 2026-07-20)
  • The signing service principal has the "Artifact Signing Certificate Profile Signer" role at the account scope

Key observation: daily certificate auto-rotation stopped after 2026-07-14 (the disable window) and has not resumed normally. Despite the profile show certificate, all data-plane sign operations still fail. This matches the behavior in Microsoft Q&A question 5915363.

This looks like a service-side hold on the signing account left over from the disable/reactivate. Is there a way to get the account state re-issuance and signing resume? Everything under our control is healthy.

Artifact Signing
Artifact Signing

A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)

0 comments
Answer accepted by question author
Christos Panagiotidis 3,551 Reputation points
2026-07-18T07:38:38.3666667+00:00

Because the operation fails through both REST and SignTool while the resource, profile, certificate, role, and subscription are healthy, this strongly indicates service-side state rather than client configuration. Artifact Signing has no documented customer command to clear a post-suspension hold or force reissuance.

Open an Azure technical support request from the affected paid subscription and select Artifact Signing. Include the subscription ID, account/profile names, endpoint, disable/reactivate timestamps, several failed operation IDs with UTC times, and the null response. Add a unique CorrelationId to one new request. Ask the service team to inspect data-plane eligibility, certificate issuance/rotation, and any suspension flag, then re-enable or reprovision the backend state.

Do not delete the account or profile while the case is open; deletion stops renewal and removes useful evidence. The West US 2 endpoint is correct, and direct REST reproduction largely rules out the dlib, SignTool, or local runtime.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.