API Management Custom Domain stopped working

Hello @Andy Childs ,

Based on the event you provided, it seems that the issue with your API Management custom domain is related to a missing CNAME record. The error message indicates that the CNAME record pointing from api.mydomain.com to a specific value was not found, resulting in a BadRequest error. To troubleshoot and resolve this issue, you can follow these steps:

1. Verify CNAME Record:
   • Double-check the CNAME record configuration for api.mydomain.com in your DNS settings. Ensure that the CNAME record is correctly set up to point to the expected value.
   • Confirm that the CNAME record is correctly propagated and accessible. Sometimes DNS changes may take time to propagate fully.
2. Check Cloudflare Settings:
   • If your domain is hosted on Cloudflare, ensure that the DNS settings in Cloudflare match the CNAME record configuration you have set up in Azure for the custom domain.
3. Validate Managed Certificate:
   • Ensure that the managed certificate associated with the custom domain is still valid and has not expired. You can check the certificate status in the Azure portal.
4. Retry Adding Custom Domain:
   • After verifying the CNAME record, retry adding the custom domain in the Azure portal. Monitor the process and check if the same error occurs after 20 minutes.
5. Contact Azure Support:
   • If the issue persists, you may need to reach out to Azure Support for further assistance in troubleshooting and resolving the problem with adding the custom domain to your API Management service.

Please follow these steps to address the missing CNAME record issue and attempt to re-add the custom domain to your API Management service. Let me know if you need further assistance or encounter any other issues.

@Aki Nishikawa ,

Thank you for your message.

The CNAME record exists as does the necessary TXT record; azure passes the initial dns checks and initially creates the custom domain but it quickly disappears and then reports an error 20 minutes later. This setup was working until Azure attempted to renew the certificate:

{
    "channels": "Operation",
    "correlationId": "ff49dada-5749-407e-a703-7a190342aee9",
    "description": "",
    "eventDataId": "acf8d9c5-d85b-c25b-7870-fa02d0d1ad2c",
    "eventName": {
        "value": "",
        "localizedValue": ""
    },
    "category": {
        "value": "Administrative",
        "localizedValue": "Administrative"
    },
    "eventTimestamp": "2025-04-16T08:36:33.2606059Z",
    "id": "/SUBSCRIPTIONS/XXXXXXXX-A529-46B8-9A09-24F7B676E453/RESOURCEGROUPS/APP_PRIMARY/PROVIDERS/MICROSOFT.APIMANAGEMENT/SERVICE/APP-APIM-PRIMARY/events/acf8d9c5-d85b-c25b-7870-fa02d0d1ad2c/ticks/638803893932606059",
    "level": "Error",
    "operationId": "",
    "operationName": {
        "value": "AUTO UPDATE FREE CERTIFICATE CHECK FAILED",
        "localizedValue": "AUTO UPDATE FREE CERTIFICATE CHECK FAILED"
    },
    "resourceGroupName": "APP_PRIMARY",
    "resourceProviderName": {
        "value": "MICROSOFT.APIMANAGEMENT",
        "localizedValue": "MICROSOFT.APIMANAGEMENT"
    },
    "resourceType": {
        "value": "MICROSOFT.APIMANAGEMENT/service",
        "localizedValue": "MICROSOFT.APIMANAGEMENT/service"
    },
    "resourceId": "/SUBSCRIPTIONS/XXXXXXXX-A529-46B8-9A09-24F7B676E453/RESOURCEGROUPS/APP_PRIMARY/PROVIDERS/MICROSOFT.APIMANAGEMENT/SERVICE/APP-APIM-PRIMARY",
    "status": {
        "value": "Failed",
        "localizedValue": "Failed"
    },
    "subStatus": {
        "value": "",
        "localizedValue": ""
    },
    "submissionTimestamp": "2025-04-16T08:36:33.2606059Z",
    "subscriptionId": "XXXXXXXX-A529-46B8-9A09-24F7B676E453",
    "tenantId": "",
    "properties": {
        "description": "Checking for updated Free Certificates in KeyVault Failed.",
        "message": "",
        "serviceName": "APP-APIM-Primary"
    },
    "relatedEvents": []
}

Hi Aki Nishikawa,

Could you kindly provide the requested information to the customer?

Hello Andy Childs,

It looks like the issue is related to the managed certificate renewal process for your custom domain. The error indicates that Azure couldn’t update the free certificate, possibly due to the CNAME record not being recognized during the check.

Please make sure:

• The CNAME record points correctly to your API Management service.
• The required TXT record is present for domain ownership.
• The managed certificate in Key Vault is accessible and has the right permissions (if applicable).

I hope this addresses your query. Please let me know if you need any further assistance or clarification.

Hi @Shireesha Eeraboina ,

Thanks for coming back to me.

• The CNAME record points correctly to the API Management service. This is confirmed by a DNS lookup and the fact that azure initially accepts the new domain as it performs a dns check. It is a subsequent later check, after 20 minutes, that fails even though the DNS record is present.
• The required TXT record is present for the domain ownership. As per the above, the initial azure check is passed.
• There is no managed certificate in a Key Vault, this is not applicable in this case.

I'm confident that this is an azure bug.

Thanks,

Andy