Error in Key Vault configuration for Azure App Service certificate

Question

Error in Key Vault configuration for Azure App Service certificate

nishino-ti 56

An error occurred when storing in Key Vault in Step 1: Store of the App Service certificate configuration in the Azure portal.

The following is a part of the activity log when the error occurred.

...
"status": {
"value": "Failed",
"localizedValue": "Failed"
},
...
"properties": {
"Message": "Failed to configure certificate order '*****' with secret name '' in Key Vault ''."

The following access policies have been applied to the key vault.

(1) Microsoft Azure App Service (all key management operations, all secret management operations, all certificate permissions)

(2) Microsoft.Azure.CertificateRegistration (all key management operations, all secret management operations, all certificate permissions)

(3) Portal operation user (all key management operations, all secret management operations, all certificate permissions)

The above error occurred on July 3, 2025, and the cause was unknown, so it was left alone.

However, when I performed the same operation on July 16, 2025, no error occurred and the storage in Key Vault was successful.

Of course, I did not change the certificate or key container settings.

Could you please give me some advice on how to check why the error was occurring?

Also, since I issued an SSL certificate from a different issuer because of the error, please tell me how to request a refund for the Azure App Service certificate.

Thank you in advance.

1 answer

Your answer

Answer 1

Hello nishino-ti,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having error in Key Vault configuration for Azure App Service certificate.

The transient Azure service errors like this typically resolve within 24-48 hours (as occurred here). For immediate needs, use third-party certificates as a workaround, but always revoke failed Azure orders to ensure refund eligibility.

Things you can do for diagnosis are the followings:

Check historical Azure status for App Service Certificates or Key Vault in your region on 2025-07-03: https://status.azure.com/status/history you can read more here https://learn.microsoft.com/en-us/azure/service-health/service-health-overview
Use Activity Log search to validate certificate order metadata:
```
   AzureActivity
     | where OperationName == "Microsoft.CertificateRegistration/certificateOrders/create"
     | where TimeGenerated >= datetime(2025-07-03) and TimeGenerated <= datetime(2025-07-04)
     | project Status, Caller, Properties
```
Look for statusMessage containing InternalExecutionError and check this link https://learn.microsoft.com/en-us/troubleshoot/azure/azure-resources/troubleshoot-deployment-activity-logs for more details.
Temporary failures occur when Azure's regional service broker loses Key Vault mapping, so check for missing vault references in certificate order:
```
   az appservice certificate show --name <CertificateName> --resource-group <RG>
```
If keyVaultId or keyVaultSecretName is null during failure window > Azure bug. Check this link https://learn.microsoft.com/en-us/azure/app-service/troubleshoot-ssl-certificates#certificate-creation-fails for more details.
For refund process with revocation
- You have to revoke unused certificate because it is required before refund approval:
```
     az appservice certificate delete --name <FailedCertificate> --resource-group <RG>
```
  Check this link - https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate#cancel-a-certificate-order for more details.
- You can request refund via Azure Support https://azure.microsoft.com/support/legal/sla/app-service/v1_5/

NOTE:

You can prevent this from happening in the future by:

Directly import certificates to Key Vault first, then bind to App Service, this is a guide from Micrsoft - https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate#import-a-certificate-from-key-vault
Test certificate deployment in staging slot before production - https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

Error in Key Vault configuration for Azure App Service certificate

1 answer

Your answer