Artifact Signing: InternalError During Sign Request After Directory Transfer — Troubleshooting HTTP 500 Error

Question

Artifact Signing: InternalError During Sign Request After Directory Transfer — Troubleshooting HTTP 500 Error

Christopher-1088 0

▎ Problem description ▎ ▎ Every sign request to Artifact Signing account compliancevine-signing (East US) with certificate profile compliancevine-public returns HTTP 500 {"errorDetail":{"code":"InternalError","message":"An internal error has occurred."}}. Failures began on 2026-11-11, shortly after subscription 4c590949-31d9-4eb6-af64-3bccc75b6838 was moved into the curatorjoyofwine.onmicrosoft.com directory by a billing ownership transfer at about 15:23 GMT. The same account and profile last signed successfully on 2026-11-09. This blocks our Windows software releases. ▎ ▎ Environment ▎ ▎ - Artifact Signing account in East US, endpoint https://eus.codesigning.azure.net/. One certificate profile (Public Trust), Active. Identity validation Completed, valid through 2028-06-05. ▎ - Signing runs from a GitHub Actions windows-latest runner (x64, .NET 8 installed). ▎ - SignTool 10.0.22621.0 (from the Microsoft.Windows.SDK.BuildTools 10.0.22621.3233 package) with Microsoft.Trusted.Signing.Client / Azure.CodeSigning.Dlib 1.0.53 (x64). ▎ - Authentication: service principal compliancevine-github-signing (client 77091810-dfce-4ad3-944d-4f072a690e54) in tenant 932c298d-ac80-43c1-9eca-17fa034ed323, through a federated credential. It holds Artifact Signing Certificate Profile Signer on the account. We created it after the move, because the move removed the previous role assignments. ▎ ▎ What I've already tried ▎ ▎ - Confirmed that token acquisition succeeds. The 500 comes from the sign call itself (CertificateProfileRestClient.SignAsync), followed by SignTool "SignerSign() failed (0x80004005)". ▎ - Confirmed in the portal that this exact principal holds the signer role on the account, that identity validation is Completed, and that the profile is Active. Accepted the updated Artifact Signing terms of use. ▎ - Reproduced three times: 18:19:40, 18:25:37 and 19:42:29 GMT on 2026-11-11. Before the third attempt, we pinned the endpoint, account name and profile name to the exact values shown in the portal. Same result. ▎ - The client log shows no request or correlation ID; only the Date header is returned. ▎ ▎ Current status ▎ ▎ All sign requests still return HTTP 500. Since nothing changed except the directory transfer, we believe the account's service-side state still references the previous tenant. Please have the Artifact Signing engineering team check the account and re-sync it to the new directory. We can grant advanced diagnostic access if that helps.

0 comments

1 answer

Your answer

Answer 1

Resolved. The cause was the subscription moving to a different Microsoft Entra tenant. Artifact Signing identity validations don't follow a subscription across tenants: the old validation still showed Completed and the certificate profile still showed Active, but daily certificate issuance had stopped, and every sign request returned 500 InternalError. Trying to create a new certificate profile from the old validation gave the real error: the subscription "is not validated for identity under Tenant" (the new tenant).

The fix was to submit a new Organization identity validation in the new tenant, wait for it to complete, then delete the old certificate profile and create a new one from the new validation. Signing worked immediately afterwards. Role assignments were also wiped by the move and had to be re-added. Note that the new validation is a new publisher identity, so SmartScreen reputation starts over.