azure cdn domain configuration issue

Hi @Kirill Semenov,

Thank you for reaching out on Microsoft Q&A forum.

I understand you’re receiving the error “Failed to update the custom domain ‘domain1’” while configuring it in your Azure CDN profile dxcmarketdr-landing. To help investigate further, could you please confirm:

1. What specific action were you performing when the error occurred? (e.g., adding the domain, enabling HTTPS, changing certificate type)
2. What is the exact hostname you’re trying to configure?
3. Have you already configured the DNS CNAME record for this domain? If yes, when was it created/last updated?
4. Are you using an Azure-managed certificate or your own custom certificate?
5. Have you confirmed that the DNS CNAME mapping is correct for the custom domain (e.g.,www.contoso.com) to point to the CDN endpoint’s default hostname?

• You can check this using: nslookup <your-custom-domain>
• The result should match the CDN endpoint hostname shown in the Azure Portal.

Once we have this information, we can proceed with targeted troubleshooting.

if you follow the link, you will see the resource name and exact place where I was performing changes. the change was in changing TLS version from 2022 to 2023

Hi @Kirill Semenov,

Based on the screenshots provided, this appears to be an issue with Azure Front Door Standard/Premium TLS policy updates through the Azure portal.

Step-by-Step Mitigation

Step 1: Verify Prerequisites and Current Configuration

1.Check Domain Validation Status

• Navigate to Azure Front Door > Settings > Domains
• Ensure your custom domain shows "Succeeded" validation state
• If status is "Pending Revalidation" or "Failed", resolve domain validation first

2.Verify Certificate Status

• Confirm the domain certificate is "Active" and not expired
• Check if certificate renewal is in progress, which can block TLS policy updates

Microsoft Documentation Reference:

• Domains in Azure Front Door | Microsoft Learn

Step 2: Use Alternative Update Methods

Option A: Use Azure CLI (Recommended)

az afd custom-domain update  --resource-group "dr-iac"  --profile-name "dxcmarketdr-landing"  --custom-domain-name "domain1"   --minimum-tls-version "TLS12"   --certificate-type "ManagedCertificate"

Option B: Use Azure PowerShell

Update-AzFrontDoorCdnCustomDomain `  -ResourceGroupName "dr-iac" `  -ProfileName "dxcmarketdr-landing" `  -CustomDomainName "domain1" `  -MinimumTlsVersion "TLS12"

Microsoft Documentation Reference:

• AFD Custom Domains - Update - REST API

Step 3: Portal-Based Troubleshooting

1.Delete and Re-add Domain Method

• Important: This will cause temporary downtime
• Remove the custom domain from Azure Front Door
• Wait 5-10 minutes for propagation
• Re-add the domain with TLS v1.2_2023 policy from the start

2.Use Custom TLS Policy Instead

• Select "Custom" instead of predefined policy
• Configure cipher suites manually to match TLS v1.2_2023 specifications. ⁠Steps for Custom TLS Policy:
• Go to Azure Front Door > Settings > Domains
• Select your domain > Edit
• Under TLS policy, select "Custom"
• Choose "Minimum TLS version: 1.2"
• Select cipher suites that match TLS v1.2_2023 policy
• Save configuration

 Microsoft Documentation Reference:

• Configure Azure Front Door TLS policy | Microsoft Learn

Step 4: Check for Known Limitations

1.Certificate Chain Issues

• Verify your managed certificate has a complete certificate chain
• If using custom certificates, ensure they meet Azure Front Door requirements

2.DNS Configuration Validation

• Ensure CNAME record points directly to Azure Front Door endpoint
• Avoid CNAME chaining which can cause certificate renewal issues

3.TLS Policy Compatibility

• Verify your origin servers support the cipher suites in TLS v1.2_2023 policy
• Check backend certificate compatibility

Microsoft Documentation Reference:

• TLS encryption - Azure Front Door | Microsoft Learn

Step 5: Monitoring and Validation

1.Monitor Deployment Progress

• Check Azure Activity Log for detailed error messages
• Monitor domain status in Azure portal

2.Validate TLS Configuration  

Microsoft Documentation Reference:

Azure Front Door TLS policy | Microsoft Learn

Best Practices Moving Forward

1. Use Latest TLS Policies: Always configure new domains with the latest available TLS policy
2. Monitor Certificate Expiry: Set up alerts for certificate renewal status
3. Test Changes in Non-Production: Validate TLS policy changes in staging environments first
4. Document Configurations: Keep records of working TLS policy configurations for reference

Microsoft Documentation References:

Azure Front Door - Best practices | Microsoft Learn

Configure HTTPS on an Azure Front Door custom domain | Microsoft Learn

Kindly let us know if you have any additional questions. Please upvote if the above was helpful.

I'm afraid that didn't work

Hi @Kirill Semenov,

The error you encountered is an internal server error on Azure's side, which can occasionally be transient. We recommend trying the operation again after some time.

Additionally, have you attempted to perform the action using the PowerShell command?

If you continue to experience errors after retrying or when using PowerShell, please let us know. We will assist you further to resolve the issue.