Azure Front Door Managed Certificate Showing Expired Status

Hi Pradeep,

When an AFD-managed certificate shows "Validation State: Approved" and "Provisioning State: Succeeded" but "Certificate State: Expired", it means DigiCert's automated CAA validation or CNAME check failed during the 45-day auto-renewal window prior to expiration.

Because Azure Front Door handles managed cert renewals automatically in the background, there is no manual "Renew" button in the Azure Portal.

Here is how to trigger a manual certificate re-issuance:

1. Verify CNAME & CAA Records: Ensure your DNS provider has your CNAME record pointing directly to your AFD endpoint (yourdomain.azurefd.net) and that no restrictive CAA records are blocking digicert.com.
2. Toggle Domain HTTPS State:
   • In Azure Portal, go to Front Door manager > Custom domains.
   • Click on your custom domain > Set Custom domain HTTPS to Disabled and save.
   • Wait 2 minutes, then set Custom domain HTTPS back to Enabled (AFD Managed).
3. Save Changes: This forces the Front Door control plane to issue a fresh DigiCert validation token and re-provision the TLS certificate immediately.

Ref: Azure Front Door Managed Certificate Auto-Renewal Guidelines

If this helps re-provision your Front Door SSL certificate, please mark as Accept Answer!

Hello @Pradeep

Thank you for reaching Microsoft Q&A platform.

The custom domain shows Validation** State = Approved and Provisioning State = Succeeded, however the Certificate State = Expired and DNS State = Certificate **needed indicate that the managed certificate renewal process was unable to complete successfully.

Please verify:

• The custom domain CNAME still points to the Azure Front Door endpoint.
• Any required domain ownership validation records are present.
• The domain does not require revalidation.

If DNS and validation records are confirmed and the certificate remains expired, this may require backend investigation to determine why certificate auto-rotation did not occur. Per Microsoft documentation, managed certificate renewal can fail when Front Door cannot validate the custom domain during the renewal process

Hello,

I resolved the issue by deleting and recreating the Azure Front Door custom domain. Prior to deletion, I removed the domain associations from the configured routes, endpoint, and WAF policy to avoid any configuration conflicts.

After recreating the custom domain, the Provisioning State was updated successfully, and the Validation State changed to Pending. Azure Front Door then generated a new domain validation TXT record, which we shared with the client for DNS configuration.

Once the client updated the TXT record in their DNS zone and the validation completed successfully, the Validation State changed to Approved, and the AFD-managed SSL certificate was provisioned successfully. The custom domain is now secured, and HTTPS is functioning as expected.

Thank you.

Best Regards,
Pradeep