App service cert failing renewal, can't validate App certs. Front door is blocking this.

Support 20 Reputation points
2026-07-22T09:52:33.1333333+00:00

We recently installed Front Door and followed the instructions for certificate installation. Our issue is that in validating our ownership of the 3 domains, we had to do this twice for all 3. Once at the app service level and again at the front door. We did this by adjusting A and C records for the domains.

Now Azure is repeatedly, as in every day, attempting to renew the app service service certificates but is failing to do so as the IP address for the validation has moved from the app service to the front door.

To try to mitigate the issue, we have installed 2 additional validated certs for 2 of the app service from a 3rd party provider.

Azure still tried to re-apply the failing certs last night, which brought all 3 instances down again.

My questions are, how do we fix this, I mean we have followed the instructions, only to find a blocker at renewal time which is bringing down the site every day, even though we have stopped using the managed certs for 2 of the app services.

The remaining 3rd cert still has a few months left at the app service layer so Azure has not yet attempted to replace it and fail.

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

Answer accepted by question author
Alex Burlachenko 25,285 Reputation points MVP Volunteer Moderator
2026-07-22T10:03:09.73+00:00

hi & thx for sharing urs issue here at Q&A portal,

This is a configuration issue rather than Front Door actively blocking certificate renewal. If Azure App Service Managed Certificates are still bound to the custom domains, App Service will continue trying to renew them. Renewal requires App Service to validate domain ownership, but once the domain is fronted by Azure Front Door, the validation path may no longer reach the App Service directly, causing the renewal to fail. If u're now terminating TLS at Front Door and using Front Door-managed or third-party certificates, you should remove the old App Service Managed Certificates and their bindings if they're no longer needed. Having multiple certificate management mechanisms for the same hostname can lead to conflicts during renewal. The more concerning part is that failed renewal attempts are bringing the sites down. That isn't expected behavior. A failed managed certificate renewal should not make an otherwise valid certificate unusable or take the application offline.

I'd open a support case with the App Service team and provide the affected app names, custom domains, Front Door profile, and the timestamps of the renewal attempts. They can determine why the platform is attempting to rebind the expired managed certificates and why those operations are disrupting production. This likely requires backend investigation rather than a configuration change alone.

https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request?source=recommendations

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/

 

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.