Title: App Service (Linux B3, Central US): custom-domain TLS handshake hangs — managed cert creates (keyVaultSecretStatus=Succeeded) but never provisions (valid=null, serverFarmId=null); SSL list stays empty ## Environment - App Service (Linux), plan SKU

Environment

• App Service (Linux), plan SKU Basic B3, region Central US
• Scale unit / stamp: waws-prod-dm1-107 (waws-prod-dm1-107.cloudapp.azure.com)
• Custom hostnames: oneview-ppw.com and [www.oneview-ppw.com]; (domain is an Azure App Service Domain; DNS in Azure DNS; www is a CNAME to the default *.azurewebsites.net host, apex is an A record to the app inbound IP)
• (Subscription ID + exact app name available privately on request.)

Symptom

HTTPS to both custom hostnames hangs at the TLS handshake and eventually

times out (browser: ERR_TIMED_OUT; curl: "Connection timed out" after the TCP

connect succeeds). Ongoing since ~2026-07-17.

What works (so the app itself is healthy)

• App state = Running. It responds instantly on its *.azurewebsites.net host.
• Over plain HTTP (:80) the custom hostname returns HTTP 301 in ~0.17s.
• TCP :443 connects fine; it is specifically the TLS handshake that never completes (hangs for all SNI, not just the custom cert).

Reproduction / diagnostics

1. az webapp config ssl list for the app returns an empty array — no certs are loaded on the app, despite the hostnames being bound.
2. hostNameSslStates show both hostnames as SniEnabled referencing cert thumbprints, but those certs are not present (dangling references).
3. Re-issued an App Service Managed Certificate for www.oneview-ppw.com: result has keyVaultSecretStatus = "Succeeded" but valid = null and serverFarmId = null — i.e. the cert is created and its Key Vault secret is fine, but it is never provisioned onto the scale unit / server farm.
4. After (re)issue + ssl bind --ssl-type SNI + az webapp restart, the SSL list is still empty (0) and the handshake still hangs.

What I've already tried (all unsuccessful)

• Rebind hostnames; delete + reissue managed certs (issues, then never loads).
• App restart (multiple).
• Scaling the plan tier (B3 → S1 → B3).
• Deleting and re-adding the custom hostname bindings.
• Confirmed DNS is correct end-to-end (delegation, CNAME, A record).
• inboundIpAddress on the app reads null.

Ask

This looks like a **certificate-provisioning / TLS-binding fault on the scale

unit (waws-prod-dm1-107)** — managed certs succeed at the control plane and in

Key Vault but never bind to the front end, so TLS can't be served for the custom

hostnames. Can you please either repair cert provisioning on this stamp or

move the app to a healthy scale unit? Happy to provide the subscription ID,

app name, and exact timestamps privately.