First thing is according to the blogs I've gone through, app service managed certificate is valid for 6months and will be renewed automatically in the last 1month of the validity period. But this isn't happening and manual steps were needed for renewing the certificate. Is there any other configuration that is to be taken care of for auto-renewal of the managed certificate or is there a way to get notified about the expiration of app service managed certificate!?

Hi @SpandanaSoma-5222 , Thanks for bringing this issue to our attention. As far as I know, there isn't a difference in setting up the auto-renewal process for App Service Certificate vs. App Service Managed Certificate. Can you please share with us what steps you followed to automatically renew your managed cert? Based on this doc , these are the steps to auto-renew managed certs: To turn on automatic renewal of your certificate at any time, select the certificate in the App Service Certificates page, then click Auto Renew Settings in the left navigation. Select On and click Save . Certificates can start automatically renewing 60 days before expiration if you have the automatic renewal turned on. Renew App Service certificate automatically Once the renew operation is complete, click Sync . The sync operation automatically updates the hostname bindings for the certificate in App Service without causing any downtime to your apps. Hope that helps. Please let us know if you have further questions. Thanks, Grace

Above "App Service Certificates" dashboard only shows purchased certificates. Managed certificates are not showed there. May be ? @Grmacjon-MSFT

Renewal of App service managed certificate

Accepted answer

Grmacjon-MSFT 16,191 Reputation points

2020-06-18T23:55:35.89+00:00

Hi @SpandanaSoma-5222,

Thanks for bringing this issue to our attention. As far as I know, there isn't a difference in setting up the auto-renewal process for App Service Certificate vs. App Service Managed Certificate. Can you please share with us what steps you followed to automatically renew your managed cert?

Based on this doc, these are the steps to auto-renew managed certs:

To turn on automatic renewal of your certificate at any time, select the certificate in the App Service Certificates page, then click Auto Renew Settings in the left navigation.

Select On and click Save. Certificates can start automatically renewing 60 days before expiration if you have the automatic renewal turned on.

Renew App Service certificate automatically

Once the renew operation is complete, click Sync. The sync operation automatically updates the hostname bindings for the certificate in App Service without causing any downtime to your apps.

Hope that helps. Please let us know if you have further questions.

Thanks,

Grace
Please sign in to rate this answer.

1 person found this answer helpful.
Spandana Soma 26 Reputation points

2020-06-19T08:57:57.753+00:00

Thankyou @Grmacjon-MSFT for the response.

I have chosen to create an app service managed certificate from the given options as in the below screen.

And the private certificate created is valid for 6months but I do not see any options of renewing the certificate.

Regards,
Spandana.

Spandana Soma 26 Reputation points

2020-06-23T16:56:59.937+00:00

Hi @Grmacjon-MSFT ,

Hope you had chance to go through my response.
Is there any update on renewal or alerting in regard with managed certificates particularly?

Regards,
Spandana.

Grmacjon-MSFT 16,191 Reputation points

2020-06-23T21:09:31.547+00:00

Thanks for providing additional info @SpandanaSoma-5222! I working internally with our engineering team to discover what might be hindering you from renewing your certs. Will update when I have accurate information to provide. We appreciate your patience.

iIn the meantime, can you share with us what you're seeing in the Azure portal when look at your App service certs.

you can find a list of all your certs by simply typing" App service certificates" in the search box of the Azure portal

Thanks,

Grace

Grmacjon-MSFT 16,191 Reputation points

2020-06-25T00:31:14.88+00:00

Hello @Spandana Soma ,

I got a response from our engineering team. There’s no way to manually renew ASMC (app service managed certificate). Generally, a lot of the common failed renewals we see happened when people switched from using CNAME records to A Records, which then will fail with renewal because ASMC doesn’t support A Records in the first place as mentioned in the docs. Given that the cert is close to expiration, we recommend you delete the ASMC and recreate a new one. Please make sure you are using CNAME Records for your domain and not switch it down the road.

hope that helps. Let us know if you have further questions.

Thanks,

Grace

Grmacjon-MSFT 16,191 Reputation points

2020-06-26T00:08:34.653+00:00

Hello @Spandana Soma ,

do you have any update for us? are you still facing this issue?

Spandana Soma 26 Reputation points

2020-06-26T11:01:19.19+00:00

Thanks @Grmacjon-MSFT for the reaching out to engineering team and responding.

The issue is now resolved.

We are using a CNAME record itself now and will be continuing with CNAME record. And yes, currently we are following the same approach, i.e., we are manually deleting and creating a new one. Also, I just want to know if there are any future improvements to be added for the renewal process.

Also, it would be helpful if there was a way to notify the users in regard with the expiration of the ASMC so that we could have track the expiry and take required steps for having it stable.

Grmacjon-MSFT 16,191 Reputation points

2020-07-02T01:19:53.743+00:00

Glad to hear this issue is now resolved. Thanks for your valuable feedback @Spandana Soma . I will share your feedback with the engineering team.

Please mark as "Accept the answer" since your issue is now resolved.

Thanks,
Grace

Steve Deller 1 Reputation point

2020-09-17T14:01:19.307+00:00

Thanks Grace,

Are there any plans to change this behavior?

Many of us run our sites behind a CDN service such as Cloudflare, and while we can disable the proxy to set them up, once the proxy protection is re-enabled, the certificates will not auto-renew, seemingly because the same "is this a CNAME" check is being performed on renewal as it is on creation.

I understand the need to verify that the certificate is for an azure-housed site on creation of the certificate, but once created the CNAME check should be removed from the renewals. Or if that is not an option perhaps some TXT record that can be placed in the DNS of the domain to verify ownership as is done for establishing custom domains.

Alternatively, there should be a manual way for us to disable the CDN proxy (revealing the underlying CNAME), initiate a certificate renewal manually from azure, and then re-enable the proxy.

Obviously from a PITA factor the first option is more desirable, but we need something.
Sign in to comment

Renewal of App service managed certificate

1 additional answer