Application Gateway stuck in a failed state

Hey Ben Hollamby,

it sounds like your App Gateway’s provisioning is stuck in a “Failed” state after the wildcard certificate renewal. Before pulling the config and recreating the gateway, here are a few things to try:

1. Check the root error

• In the Azure portal, go to your Application Gateway’s Activity log or the “Provisioning State” details and look at the error message/time stamp from the failed SSL upload.
• If you’re using PowerShell, run:

  
       Get-AzApplicationGateway -Name <yourAppGwName> -ResourceGroupName <rgName> | Select-Object ProvisioningState, OperationalState
  
  

• That error should indicate whether it’s a bad certificate file, Key Vault access issue, IP mismatch, etc.

2. Fix any certificate or Key Vault issues
   • If you imported a PFX directly, double-check the PFX password and that the cert includes the private key.
   • If you’re pulling the cert from Key Vault: • Ensure the gateway’s managed identity has “get” permission on the KV secret. • If your KV has a firewall enabled, add the App Gw subnet (or virtual network) to the KV allow list.
   • After adjusting permissions or cert, retry the upload.

3. Trigger a configuration PUT to recover from Failed state

• Sometimes simply re-submitting the gateway config forces it out of “Failed.” In PowerShell:

  
       $gw = Get-AzApplicationGateway -Name <yourAppGwName> -ResourceGroupName <rgName>
  
       Set-AzApplicationGateway -ApplicationGateway $gw
  
  

• Or in the portal, make any harmless change (e.g. add then remove a tag) and click “Save.”

4. Run the built-in diagnostics

• Azure portal → Application Gateway → Diagnose and solve problems
• Run the “Failed configuration” diagnostic to see if there are NSGs, UDRs, conflicting IPs or SSL/Key Vault errors blocking updates.

5. Validate recovery

• Re-run Get-AzApplicationGateway and confirm ProvisioningState is “Succeeded” and OperationalState is “Running.”
• Check that your listeners are still serving traffic normally.

If after all that the gateway still won’t recover, you can export the ARM template (or copy the PowerShell config), delete the gateway resource, and redeploy it with the same settings and cert binding. That approach works, but usually the Get-/Set-AzApplicationGateway trick or fixing the cert/KV permission is enough.

Reference list

• Recover an Application Gateway from Failed state: https://docs.microsoft.com/azure/application-gateway/application-gateway-troubleshoot-failed-state
• Key Vault allow list + PowerShell GET/SET: https://docs.microsoft.com/azure/key-vault/general/network-security#key-vault-firewall-enabled-virtual-networks---dynamic-ips https://docs.microsoft.com/powershell/module/az.network/get-azapplicationgateway https://docs.microsoft.com/powershell/module/az.network/set-azapplicationgateway
• Common Key Vault errors in App Gateway: https://docs.microsoft.com/azure/application-gateway/application-gateway-key-vault-common-errors

Hope this helps!

Thank you.

Hello @ Ben Hollamby
Thank you for contacting us about the application gateway issue. We have begun looking into it and will share our suggestions with you as soon as possible.