Azure Container Apps
An Azure service that provides a general-purpose, serverless container platform.
Azure Container App custom domain feature not working
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 26%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPC%3C/text%3E%3C/svg%3E)
Patrick Corbett
0
Reputation points
I have gone round and round this circle a few times now and am not sure why it isnt working.
This is the timeline of events:
- Deploy a container app ~6months ago
- Successfully configure a custom sub-domain that points at the container app
- remove that container app in the process of setting up IIAC (bicep) files and testing from-scratch deployments
- deployment fails to assign custom domain to azure container app
- The certificate issuance fails?
- manually create an azure container app
- attempt to assign custom sub-domain
- custom sub-domain fails to bind (certificate status failed)
I have definitely set the required asuid and CNAME records in my domain settings
Even just seeing why the domain is cannot generate a certificate would be awesome.
Azure Container Apps
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 79%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERA%3C/text%3E%3C/svg%3E)
Rupesh Asati 945 Reputation points Microsoft External Staff Moderator2025-11-07T13:55:39.41+00:00 Hello Patrick Corbett
Thanks for reaching out on Microsoft Q&A and really appreciate your patience while we looked into this.
you are running into issue with assigning a custom domain and getting the certificate issuance to work for your Azure Container App.
Steps:
- Verify DNS Records: Ensure that you've set up the following DNS records correctly:
- A Record: For apex domains, this should point to your Container Apps environment's IP address.
- CNAME Record: For subdomains, this should map directly to the generated domain name of your container app (not to any intermediate CNAME).
- TXT Record: This should include the domain verification code. The format will depend on whether you're using an A or CNAME record.
- Check if HTTP Ingress is Enabled: Make sure that HTTP ingress is enabled for your Container App, as this is required to issue a managed certificate.
- DNS Propagation: Changes to your DNS records might take some time to propagate globally.
- Public Accessibility: Ensure your Container App is publicly accessible from the necessary IP addresses for certificate validation.
- Managed Certificate Requirements: Confirm that your setup meets the requirements for getting a free managed certificate. The prerequisites include correct DNS configuration and the Container App being publicly accessible.
- Check for Private Endpoints: If you're using private endpoints, make sure they are correctly configured, as they may interfere with domain validation processes.
- Common Issues: Review the common issues that could prevent domain validation such as misconfigured DNS records, outdated cached records, or other external services (like Cloudflare) that may impact DNS resolution.
Custom Domain Names and Free Managed Certificates in Azure Container Apps
Troubleshoot Domain and TLS/SSL Certificate Problems in Azure App Service
Required DNS Records for Custom Domains
I hope this helps in resolving the issue, do let me know if you have any further questions on this.
Thanks
- Verify DNS Records: Ensure that you've set up the following DNS records correctly:
-
Patrick Corbett 0 Reputation points
2025-11-08T05:18:13.8566667+00:00 I am using a sub-domain so I have added the CNAME and
asuidTXT records for the subdomain.I continually get the error that
"domainControlValidation": "CNAME","error": "Operation timed out."In the CLI Tool when I check the certificate status
I can verify the asuid and CNAME records exist with DIG
My azure container app does allow HTTP ingress
My azure container is binding to port 50051 and is a GRPC service. Does this matter?
Sign in to comment
Sign in to answer