domain verification taking too long or not completing in Azure App Service.

Question

domain verification taking too long or not completing in Azure App Service.

Olga_Gh 180 Microsoft Employee Admin

My domain is managed on the same azure account / subscription where I am trying to obtain the SSL certificate. The TXT has been added to the DNS

0 comments

1 answer

Your answer

Answer 1

If the domain is in the same subscription, the fastest verification path is usually App Service verification when the domain is already mapped to the App Service app. If verification is still taking too long, use this checklist:

Confirm the domain is already mapped to the web app In the App Service Custom domains blade, make sure the hostname is added to the app first. Azure recommends mapping the domain before buying the certificate.
Use the correct verification method For an App Service certificate, Azure supports:
- App Service verification
- Domain verification
- Mail verification
- Manual verification by DNS TXT or HTML page
If App Service verification is not completing, switch to Manual (DNS) verification and use the TXT record value shown in the certificate configuration.
Verify the TXT record placement For manual DNS verification, the TXT record must be added at the root domain level using @ for the name, with the domain verification token as the value. After adding it, wait a few minutes and select Refresh in the portal.
Keep refreshing the certificate status After verification is initiated, select Refresh until the certificate shows that the domain is verified.
If HTML verification was used, avoid it when HTTPS Only is enabled HTML verification can fail if HTTPS Only is turned on or if the app routing blocks access to the verification file. In that case, use DNS TXT verification instead.
If the domain was already mapped before certificate purchase, prefer App Service verification This is the easiest method when the domain is already mapped to the app in the same subscription.
Check for renewal-specific re-verification If this is a renewal and more than 13 months (395 days) have passed since the last verification, the CA requires domain verification again before renewal completes.
If verification still does not complete
- Make sure the TXT record value exactly matches the token shown in Azure.
- Make sure the record is visible in DNS after propagation.
- Retry Refresh after a few minutes.
- If one verification method fails, try another supported method.
If the certificate order stays pending Azure CLI cannot perform the verification directly, but it can confirm whether the certificate order is still pending:
```
   az resource show -g <ResourceGroupName> -n <CertificateName> --resource-type Microsoft.CertificateRegistration/certificateOrders --query "properties.provisioningState"
```
If the state is Pendingissuance or similar, domain verification is not yet complete and must be finished in the portal or by an out-of-band method.
Important timing limit Certificate purchase has 15 days to complete domain verification. After that, the CA denies the certificate and the certificate should be deleted and retried.