App Service Certificate Issued Successfully but Key Vault Certificate Object Not Created (Only Secret Exists)

What is supported for App Service certificates is that the certificate is stored in Azure Key Vault as a secret. The documented troubleshooting flow explicitly states that an App Service certificate is stored as a secret in Key Vault, and several failure modes are described in terms of the secret not being readable or not syncing to App Service.

Based on that, the absence of a visible Key Vault Certificate object does not by itself indicate that the App Service certificate is invalid, especially since these are already true in this case:

1. The App Service Certificate shows Issued.
2. Store, Verify, and Assign are successful.
3. The secret exists in Key Vault with application/x-pkcs12.
4. The site is already serving the certificate successfully after PFX upload.

For the specific questions:

1. The documented App Service certificate flow is centered on the Key Vault secret, not on a required Key Vault certificate object. The context does not state that a Key Vault Certificate object must always appear under Key Vault → Certificates for App Service Certificate scenarios.
2. The context does confirm that permission model and Key Vault integration issues can break certificate setup and sync. It also notes that missing or incorrect Key Vault permissions, RBAC-related configuration, or vault reconfiguration can cause certificate access and propagation problems. That makes the earlier RBAC-to-access-policy change a plausible contributing factor to the inconsistent state, but the supported fact is only that Key Vault permission/configuration issues can affect certificate usage and renewal.
3. No supported procedure is provided to recreate only the missing Key Vault Certificate object while preserving the existing App Service certificate state. The supported recovery actions in the context are:
   • restore the required Key Vault access policies,
   • use Rekey and Sync > Sync to force App Service to pick up the current certificate,
   • use Import App Service Certificate in the web app TLS/SSL settings,
   • or, as a last resort, export the certificate from Key Vault and upload the PFX manually.

Since the PFX workaround is already in place and HTTPS is working, the closest supported guidance is:

1. In the Azure portal, open the App Service Certificate resource and verify the Key Vault status and store association.
2. In Key Vaults > [Vault] > Access policies, confirm these principals still exist with the documented permissions:
   • Microsoft Azure Web Service (Microsoft.Azure.WebSites) with Secret: Get and Certificate: Get
   • Azure Certificate Registration (Microsoft.Azure.CertificateRegistration) with Secret: Get, List, Delete
3. In the web app, go to TLS/SSL Settings > Private Key Certificates (.pfx) and try Import App Service Certificate. If the certificate resource is healthy but not linked into the app, this is the supported import path.
4. If renewal later does not propagate, use Rekey and Sync > Sync after confirming Key Vault access is correct.
5. If the app continues to work only with the manually uploaded PFX, keep in mind that this bypasses automatic sync benefits.

A key point from the documentation is that App Service and related integrations read certificates from Key Vault as secrets. That aligns with the current state where the secret exists even though Key Vault → Certificates is empty.

References:

• Troubleshoot Azure App Service certificates
• Troubleshoot certificate management and Azure Key Vault integration in Azure Application Gateway