Unable to create an App Service Managed Certificate

Question

Unable to create an App Service Managed Certificate

Jim Jackson 80

We are unable to create an App Service Managed Certificate for transfer.sundance-inc.net on App Service SundanceTransfer in resource group Sundance_Group. The hostname is attached and verified. DNS resolves correctly to the App Service default hostname. No SSL binding exists and az webapp config ssl list returns no certificate for this resource group. We removed and re-added the custom domain and manually deleted the stale certificate resource transfer.sundance-inc.net-SundanceTransfer, which returned Delete Certificate Succeeded / HTTP 204. However, both portal-based and Azure CLI-based managed certificate creation fail. The Activity Log shows Add or Update Certificate Failed with error: Pending managed certificate failed: Pending certificate expired. Latest correlation ID: ebf112ab-7ade-4abe-8479-00e229664f1f. Please investigate and clear any stale backend managed certificate provisioning state for this hostname/resource.
edited PII

Praneeth Maddali 12,670 Reputation points Microsoft External Staff Moderator

2026-08-11T23:25:02.2966667+00:00

as we have ongoing discussions on below case closing this case
https://learn.microsoft.com/en-us/answers/questions/5972727/cant-create-certificate?comment=question&translated=false#newest-question-comment

Answer accepted by question author

0 additional answers

Your answer

Praneeth Maddali 12,670 Reputation points Microsoft External Staff Moderator

2026-08-11T23:25:02.2966667+00:00

as we have ongoing discussions on below case closing this case
https://learn.microsoft.com/en-us/answers/questions/5972727/cant-create-certificate?comment=question&translated=false#newest-question-comment

Answer 1

Hi @Jim Jackson

from teams chat we can confirm the issue is fixed

.From the deep investigation we found that the managed certificate creation is failing because of a CAA (Certification Authority Authorization) restriction on the domain. The records inherited from the parent domain sundance-inc.net currently authorize only trust-provider.com and ssl.com. Azure App Service Managed Certificates are issued by DigiCert, and DigiCert is not listed as an allowed issuer. As a result, the certificate request stays in a pending state until it expires, which produces the error you are seeing:

Pending managed certificate failed: Pending certificate expired.

This is called out directly in the diagnostics under “CAA Records – DigiCert Not Authorized.”

Recommended action

Please update the CAA records for sundance-inc.net (or at the transfer.sundance-inc.net level if your DNS provider supports it) to include DigiCert. The required record is:

Knowledge base

0 issue "digicert.com"

You can keep the existing records for the other providers if they are still needed. After the change, allow time for DNS propagation (typically up to a few hours) and verify with a tool such as digwebinterface.com (query type CAA).

Once DigiCert is authorized:

Remove the custom domain transfer.sundance-inc.net from the App Service.
Wait 10–15 minutes.
Re-add the custom domain.
Create the App Service Managed Certificate again.

You may also want to confirm that the asuid.transfer.sundance-inc.net validation record is present, as one of the diagnostic checks flagged a missing ownership verification record.

Relevant Microsoft documentation:

Create a free managed certificate (notes the DigiCert CAA requirement)
App Service Managed Certificate changes (July 2025)
Troubleshoot Azure App Service certificates

Please let us know once the CAA record has been updated and whether the certificate issues successfully after the retry. Happy to assist further if needed.