---
id: 6ea80f92-685c-4ea7-acd2-edccfe97b297
---

# Azure Webapp Certificate Renewal Failures
---

This incident type refers to a failure in the auto-renewal process of SSL/TLS certificates for Azure Webapp services. This can result in expired certificates, leading to potential security vulnerabilities and interruptions in service. The resolution involves ensuring that the SSL/TLS certificates are configured correctly for auto-renewal, updating certificate settings, and manually renewing certificates if necessary.

### Parameters
```shell
export APP_NAME="PLACEHOLDER"

export RESOURCE_GROUP="PLACEHOLDER"

export CERTIFICATE_NAME="PLACEHOLDER"

export CERTIFICATE_FILE_PATH="PLACEHOLDER"

export CERTIFICATE_PASSWORD="PLACEHOLDER"
```

## Debug

### List all enabled hostnames for the specific web app
```shell
az webapp show --name ${APP_NAME} --resource-group ${RESOURCE_GROUP} --query "hostnameSslStates"
```

### List the SSL certificates for a specific web app
```shell
az webapp config ssl list --resource-group ${RESOURCE_GROUP} --query "[].name"
```

### View detailed SSL certificate information for a specific binding
```shell
az webapp config ssl show --resource-group ${RESOURCE_GROUP} --certificate-name ${CERTIFICATE_NAME}
```

### Check the expiration date of an SSL certificate
```shell
az webapp config ssl show --resource-group ${RESOURCE_GROUP} --certificate-name ${CERTIFICATE_NAME} --query "expirationDate" --output tsv
```

### Verify that the SSL certificate is a managed certificate
```shell
az webapp config ssl show --resource-group ${RESOURCE_GROUP} --certificate-name ${CERTIFICATE_NAME} --query "type" --output tsv
```

## Repair

### Manually renew an SSL certificate
```shell
#!/bin/bash



# Set variables

PFX_PATH=${CERTIFICATE_FILE_PATH}

PFX_PASSWORD=${CERTIFICATE_PASSWORD}

APP_NAME=${APP_NAME}

RESOURCE_GROUP=${RESOURCE_GROUP}



# Upload the SSL certificate and get the thumbprint

thumbprint=$(az webapp config ssl upload --certificate-file $PFX_PATH --certificate-password $PFX_PASSWORD --name $APP_NAME --resource_group $RESOURCE_GROUP --query thumbprint --output tsv)



# Bind the uploaded SSL certificate to the webapp



az webapp config ssl bind --certificate-thumbprint $thumbprint --ssl-type SNI --name $APP_NAME --resource-group $RESOURCE_GROUP




```

This incident type refers to a failure in the auto-renewal process of SSL/TLS certificates for Azure Webapp services. This can result in expired certificates, leading to potential security vulnerabilities and interruptions in service. The resolution involves ensuring that the SSL/TLS certificates are configured correctly for auto-renewal, updating certificate settings, and manually renewing certificates if necessary.


```shell
export APP_NAME="PLACEHOLDER"

export RESOURCE_GROUP="PLACEHOLDER"

export CERTIFICATE_NAME="PLACEHOLDER"

export CERTIFICATE_FILE_PATH="PLACEHOLDER"

export CERTIFICATE_PASSWORD="PLACEHOLDER"
```


### List all enabled hostnames for the specific web app

```shell
az webapp show --name ${APP_NAME} --resource-group ${RESOURCE_GROUP} --query "hostnameSslStates"
```

### List the SSL certificates for a specific web app

```shell
az webapp config ssl list --resource-group ${RESOURCE_GROUP} --query "[].name"
```

### View detailed SSL certificate information for a specific binding

```shell
az webapp config ssl show --resource-group ${RESOURCE_GROUP} --certificate-name ${CERTIFICATE_NAME}
```

### Check the expiration date of an SSL certificate

```shell
az webapp config ssl show --resource-group ${RESOURCE_GROUP} --certificate-name ${CERTIFICATE_NAME} --query "expirationDate" --output tsv
```

### Verify that the SSL certificate is a managed certificate

```shell
az webapp config ssl show --resource-group ${RESOURCE_GROUP} --certificate-name ${CERTIFICATE_NAME} --query "type" --output tsv
```


### Manually renew an SSL certificate

```shell
#!/bin/bash



# Set variables

PFX_PATH=${CERTIFICATE_FILE_PATH}

PFX_PASSWORD=${CERTIFICATE_PASSWORD}

APP_NAME=${APP_NAME}

RESOURCE_GROUP=${RESOURCE_GROUP}



# Upload the SSL certificate and get the thumbprint

thumbprint=$(az webapp config ssl upload --certificate-file $PFX_PATH --certificate-password $PFX_PASSWORD --name $APP_NAME --resource_group $RESOURCE_GROUP --query thumbprint --output tsv)



# Bind the uploaded SSL certificate to the webapp



az webapp config ssl bind --certificate-thumbprint $thumbprint --ssl-type SNI --name $APP_NAME --resource-group $RESOURCE_GROUP




```


Azure Webapp Certificate Renewal Failures

Overview

Parameters

Debug

List all enabled hostnames for the specific web app

List the SSL certificates for a specific web app

View detailed SSL certificate information for a specific binding

Check the expiration date of an SSL certificate

Verify that the SSL certificate is a managed certificate

Repair

Manually renew an SSL certificate

Learn more

Related Runbooks

Support