The managed TLS certificate for the apex custom domain domain.com expired... Azure's automatic certificate renewal: FAILED

Anthony Mattocks 20 Reputation points
2026-08-04T17:15:35.46+00:00

Remediation attempted:

  1. Removed and re-added the (domain.com) custom domain binding (az staticwebapp hostname delete / set --validation-method dns-txt-token), since Azure exposes no "retry renewal" action.
  2. Added the resulting TXT validation token to the domain.com zone (hosted on an internally-managed Windows DNS Server). Validation succeeded within minutes — hostname status moved from Validating to Ready, and the resource's backend metadata (az resource show) confirms a new certificate has been issued, with expiresOn: 2027-02-04.

Current stuck state: Despite backend confirmation that the new certificate exists, it has not propagated to Azure's edge network. Over several hours of repeated checks (openssl s_client -servername domain.com), the live TLS handshake has oscillated between two incorrect states — the old expired domain.com certificate (notAfter=2026-08-03), and a generic fallback certificate (CN=*.azureedge.net, unrelated to this domain) — with no observed instance of the correct new certificate being served. This back-and-forth pattern over an extended period, rather than a steadily improving rollout, suggests the edge propagation itself is stuck rather than simply slow.

Azure Static Web Apps
Azure Static Web Apps

An Azure service that provides streamlined full-stack web app development.

0 comments
Answer accepted by question author
Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator
2026-08-04T17:30:20.99+00:00

Hi @Anthony Mattocks ,

Thanks for reaching out in Microsoft Q&A forum,

As discussed through Microsoft Teams, we reviewed the latest updates regarding the custom domain and certificate issue.

Based on the current configuration, domain.com is no longer hosted as a custom domain on Azure Static Web Apps. The domain was intentionally removed from Static Web Apps and moved to Azure Front Door.

The current status is:

  • The Azure Front Door custom domain configuration is showing the certificate as valid/successful.
  • The required DNS TXT validation record was added successfully.
  • However, the browser is still displaying a privacy/certificate warning when accessing https://domain.com.

Since the domain and certificate are now managed by Azure Front Door, the remaining issue is related to the Front Door certificate deployment/edge serving path rather than Azure Static Web Apps.

For Static Web Apps, we have confirmed that there is no active custom domain configuration for domain.com. We recommend continuing the investigation from the Azure Front Door side to verify the certificate currently being served at the edge and check for any propagation or synchronization delays.

Update:

The issue appears to be resolved now. The custom domain domain.com was moved from Azure Static Web Apps to Azure Front Door, and the certificate is now working as expected.

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to 210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.