Pending Issuance - Azure SSL App Service Certificate

Question

I have a Azure Web App that has a SSL Certificate. This certificate is set to auto-renew.

However it has stopped working. When I log on to the Azure portal, it says "perform required domain verification" and the status of the Certificate says "Pending Issuance". The expiry date is yesterday, so I guess it has expired.

But....

Why didn't it auto-renew? Why is it telling me to verify the domain again? (I did this when I bought it 2 years ago)

I looked at the steps in the portal to verify the domain by updating the txt record in my DNS. Done that. It's been like an hour and it still doesn't work.

Do I need to just wait?

Can anyone explain whats going on here?

Answer 1

In the end what I did was delete the current Certficate and create a new one. - That got the site back up and running without waiting around.

Answer 2

Glad you got it working.Just to highlight on renewal of certificate. As mentioned in this doc "Beginning September 23 2021, App Service certificates require domain verification during renew or rekey if you haven't verified domain in the last 395 days. The new certificate order remains in "pending issuance" during renew or rekey until you complete the domain verification.

Unlike App Service Managed Certificate, domain re-verification for App Service certificates is not automated, and failure to verify domain ownership will result in failed renewals. Refer to verify domain ownership for more information on how to verify your App Service certificate."

If you are going to renew/rekey your certificate, and it's been > 395 days since you last verified domain ownership, you would be required do verify domain ownership again in order to have the new certificate be issued to you. If it's been < 395 days, your certificate will be automatically issued again without additional action needed from you. Similar discussion here.