Unable to Bind Managed Certificates to Custom Domains in Azure Container Apps (Silent Failure on New Domains)

Question

Unable to Bind Managed Certificates to Custom Domains in Azure Container Apps (Silent Failure on New Domains)

Ajit Singh 20

We are using Azure Container Apps to host a multi-subdomain website (*.all-architecture.co.uk) with more than 150 custom domains successfully bound using Azure-managed certificates.

In the last two weeks, we added 30+ new subdomains and successfully generated the managed certificates (status: Succeeded) via the Azure Container App Environment.

However, these new certificates:

Appear under the Certificates section of the Container Apps Environment

Are not selectable when attempting to bind the domain to the Container App (via Portal UI → "Add Binding")

Even when editing the JSON directly (via Resource Explorer), providing the correct certificate path under /certificates/... results in no error but also no effect — the domain remains Disabled

We have validated:

Certificates are issued and match the domain name

Binding works for older certificates/domains

This appears to be a silent failure or new limitation

This issue is blocking HTTPS support for newly added locations on our production website.We are using Azure Container Apps to host a multi-subdomain website (*.all-architecture.co.uk) with more than 150 custom domains successfully bound using Azure-managed certificates.

In the last two weeks, we added 30+ new subdomains and successfully generated the managed certificates (status: Succeeded) via the Azure Container App Environment.

However, these new certificates:

Appear under the Certificates section of the Container Apps Environment

Are not selectable when attempting to bind the domain to the Container App (via Portal UI → "Add Binding")

Even when editing the JSON directly (via Resource Explorer), providing the correct certificate path under /certificates/... results in no error but also no effect — the domain remains Disabled

We have validated:

Certificates are issued and match the domain name

Binding works for older certificates/domains

This appears to be a silent failure or new limitation

This issue is blocking HTTPS support for newly added locations on our production website.

Steps to Reproduce:

Add a new custom domain to Azure Container App (e.g., barnes.all-architecture.co.uk)
Let Azure generate the managed certificate (succeeds)
Attempt to bind certificate via Portal or Resource Explorer
No certificate is selectable in UI, and editing customDomains JSON with correct certificateId does nothing (bindingType stays Disabled) Expected Behavior:
- Managed certificate appears in dropdown when binding the domain
- bindingType can be successfully changed to "SniEnabled" using the matching certificate

Actual Behavior:

Certificates are successfully created but not bindable

Silent failure in Portal and API when attempting to associate certificate to domain

Sai Prabhu Naveen Parimi 3,470 Reputation points Microsoft External Staff Moderator

2025-07-07T17:15:32.3466667+00:00

@Ajit Singh

It seems like you're facing an issue with your Azure Function processing only one session from a sessioned queue at a time, which is causing delays and dead lettering of messages with different session IDs. This can definitely impact efficiency!

The behavior you're observing is due to the nature of session processing in Azure Service Bus. When sessions are enabled, each session is processed sequentially by a single function instance. To process multiple sessions concurrently, you'll need to adjust your approach. Here are a few things you can consider:

Scale Out Azure Function Instances: Instead of a single instance handling the sessions, you can scale out your function app to allow multiple instances to process different sessions simultaneously. You can achieve this by configuring the Azure Function scaling settings. Make sure your hosting plan supports scaling (like Premium or Dedicated).

Use Multiple Session Processors: Set up multiple instances of session processors so that different session IDs are picked up concurrently. This could involve creating separate functions for different session IDs or using a session processor pattern.

Adjust SessionIdleTimeout: As mentioned in the troubleshooting guide, you might want to tweak the SessionIdleTimeout setting. This determines how long the session processor waits before switching to another session. Ensure it's set appropriately based on your message arrival pattern.

Monitor and Optimize Message Patterns: Ensure that messages are naturally spread across multiple sessions rather than being concentrated in a few sessions. This can help improve throughput.

Use Asynchronous Processing: Engage in async call patterns within your function to ensure that processing can happen concurrently even within a single instance.

Make sure your Azure Function app is in either the Standard or Premium tier since the Basic tier does not support sessions.

Hope this helps you improve the message processing!
Ajit Singh 20 Reputation points

2025-07-07T17:19:38.7066667+00:00

This issue not related Azure Function or Azure Service Bus but Azure Container App Custom Domain Managed Certificate Binding.
This was working till last week but not letting me bind the new managed TSL certificate to new Custom Domain
Anurag Rohikar 285 Reputation points Microsoft External Staff Moderator

2025-07-30T05:39:38.1633333+00:00

Hello Ajit Singh, please reach out to us via private message so we can assist you further. Thanks!

2 answers

Your answer

Ajit Singh 20 Reputation points

2025-07-07T17:19:38.7066667+00:00

This issue not related Azure Function or Azure Service Bus but Azure Container App Custom Domain Managed Certificate Binding.
This was working till last week but not letting me bind the new managed TSL certificate to new Custom Domain
Anurag Rohikar 285 Reputation points Microsoft External Staff Moderator

2025-07-30T05:39:38.1633333+00:00

Hello Ajit Singh, please reach out to us via private message so we can assist you further. Thanks!

Answer 1

Jeremy Buisson 5

Exactly same issue reported on my side. Existing bindings are still working well but adding new one using same process is no more possible:

User's image

PG 0 Reputation points

2025-07-11T07:36:32.46+00:00

I also have the same problem now - custom domain with managed cert does not work even for simplest case of one domain, it cannot assigned generated certificate anymore (not selecteable).

The workaround is to stop use azure and move to use caddy etc.
Ian Wallace 10 Reputation points

2025-07-11T08:05:58.1166667+00:00

I have exactly the same problem. I've created dozens of these recently. Suddenly they no longer work.
Aung Khant Min 0 Reputation points

2025-08-07T11:32:23.8033333+00:00
az containerapp hostname bind \

--name <NAME>\ --resource-group <RESOURCE_GROUP> \ --hostname yourdomain.com \ --environment <ENVIRONMENT_NAME> \ --certificate <CERTIFICATE_NAME_OR_ID>

this command work try from cli. i just solve it using that today.

Answer 2

Flávio Campelo 0

I'm facing same issue here. From Azure Container Apps (ACA), I added an new custom domain using managed certificate option. So, I see the custom domain is shown in ACA, a new certificate for that domain is automatically created in the Azure Container Environment (ACE), but the custom domain remains never bound. Even I click to edit custom domain to bind it, the selecte option shows nothing. But certificate exists in ACE for the right domain (Remember this certificate was automatically created).

Share via

Unable to Bind Managed Certificates to Custom Domains in Azure Container Apps (Silent Failure on New Domains)

2 answers

Your answer