Unable to Renew Expired Azure App Service Wildcard SSL Certificate – Need Assistance

Because the certificate order is already Expired and Azure rejects both renewal and Auto Renew changes, purchase and issue a new wildcard App Service Certificate, bind it to every affected hostname, verify it in production, and only then remove the expired certificate.

Microsoft’s troubleshooting guidance states that when an App Service Certificate is marked Expired or Renewal Failed, it was not renewed in time and a new certificate should be purchased—even if Auto Renew had been enabled but a validation requirement was not completed in time.^1^

Replace it without disrupting bindings

1. Keep the existing certificate resource and bindings temporarily.
   Do not delete the expired binding first. Removing an IP-based binding can change the app’s inbound IP address.^2^
2. Purchase the replacement wildcard certificate.
   • Azure portal → Create App Service certificate.
   • Select the correct subscription and resource group.
   • For SKU, select Wildcard certificate.
   • Enter the domain and enable Auto renewal.
   • Select Review + Create → Create.^3^
3. Complete certificate configuration.
   • Open App Service Certificates → select the new certificate.
   • Go to Certificate Configuration → Step 1: Store and select the Key Vault. The vault should be in the appropriate subscription/resource group configuration, and the Certificate Registration resource provider must retain the required Key Vault permissions.
   • Go to Certificate Configuration → Step 2: Verify.
   • Complete App Service Verification, DNS TXT verification, or another offered method.
   • Select Refresh until Certificate is Domain Verified appears.^3^
4. Import the new certificate into each App Service.
   • App Service → Settings → Certificates.
   • Select Bring your own certificates (.pfx) → Add certificate.
   • Set Source to Import App Service Certificate.
   • Select the new certificate, validate it, and select Add.^2^
5. Switch each hostname binding in place.
   • App Service → Custom domains.
   • For each affected hostname, select … → Update binding.
   • Select the new certificate and choose Update.
   • Repeat for every app, slot, root domain, and wildcard-covered subdomain using the old thumbprint.^2^
6. Validate before cleanup.
   • Browse to each HTTPS hostname and inspect the certificate’s subject, wildcard coverage, thumbprint, and expiration date.
   • After all bindings serve the new certificate, remove the expired certificate imports and old resource if no application code or other service still depends on it.

Why Auto Renew could have failed

Auto Renew begins approximately 32 days before expiration, but purchased App Service Certificates do not have automatic domain reverification. Renewal or rekey can require domain ownership verification again; if it is not completed, the new order remains Pending issuance and can ultimately fail. Renewal also depends on the App Service Certificate service principal retaining its Key Vault permissions.^3^

Your subscription’s billing restriction is also a plausible blocker. Microsoft lists payment or subscription problems as a cause of failed renewal for paid App Service Certificates, including an invalid payment method or an offer that no longer supports the purchase. Resolving the billing restriction does not retroactively recover an order that has already reached Expired status.^1^

To identify the actual cause, preserve and collect:

• Certificate order resource name and resource ID
• Subscription and resource group
• Expiration date and status
• Auto Renew setting
• Azure Activity Log entries covering the 32 days before expiration
• Domain-verification state and related messages
• Key Vault status, permission changes, and audit events
• Dates of the subscription or billing restriction
• Renewal-failure notifications and correlation IDs

Recovery and Microsoft Support

The documentation provides no supported post-expiration grace-period procedure for restoring this certificate order. Manual Renew is documented for the normal renewal window before expiration; the errors shown indicate that the existing order is no longer accepting that operation.^3^

Open Azure portal → Help + support → Create a support request and select the subscription containing the certificate. Use:

• Issue type: Technical
• Service: App Service Certificates / App Service
• Also open a Billing request if the restriction or failed renewal charge needs investigation.

Support can investigate the renewal attempt, platform records, billing state, and whether an exceptional recovery action exists, but the public guidance does not establish that Support can reactivate or manually restore an expired order. Subscription-management and billing support are available without a technical support plan; technical investigation normally requires a support plan.^4^

References

1. Troubleshoot Azure App Service certificates
2. Add and manage TLS/SSL certificates in Azure App Service
3. Buy and manage App Service certificates
4. Create an Azure support request