AFD managed certificate not propagating to edge nodes after subscription reinstatement

Question

AFD managed certificate not propagating to edge nodes after subscription reinstatement

Mike Meyers 0

Hey,

We are experiencing an issue with Azure and our Front Door settings. Our monthly payment was delayed, which caused about an hour of downtime for all our services. That issue has been resolved, so everything is working on that front.

However, our images are not being loaded in the frontend anymore. Everything looks fine in Azure itself, but when we try to fetch the images, we get the following error:

URL: https://media.orfit.com/strapi-uploads/media/logo_f682c5e347.svg
Response: net::ERR_CERT_COMMON_NAME_INVALID

This was working before the downtime, and now we are seeing this error. Could you fix this on your side, or advise us on the best way to resolve it?

Thanx in advance.
With kind regards,
Mike Meyers

Screenshot 2026-03-26 at 17.41.38

Venkatesan S 5,710 Reputation points Microsoft External Staff Moderator

2026-03-26T18:30:35.9833333+00:00
Hi Mike Meyers,

It looks like your custom domain’s managed cert didn’t make it out to the edge after the subscription came back online so browsers are still seeing the default “*.azurefd.net” cert (hence the CN mismatch). Here’s how you can troubleshoot and get HTTPS back up:

Verify your DNS • Run nslookup media.orfit.com (or use an online DNS checker) to ensure the CNAME is pointing exactly at your Front Door endpoint (e.g. yourfrontdoorname.azurefd.net). • If the CNAME is missing or pointing elsewhere, the managed cert won’t issue/apply.

Check the custom-domain + cert status in the portal • In Azure Portal go to your Front Door (Classic) → Frontend/domains → select media.orfit.com. • Under “Certificate management type” you should see Enabled and a valid expiry date. – If it’s Not enabled, Pending, or shows Custom domain unavailable, click Edit, reselect Azure Front Door managed certificate, then save. • Keep in mind it can take ~60 minutes for a Classic-SKU cert change to propagate to all edge POPs.

Wait for propagation or force a re-issue • After you re-enable the managed cert, wait up to an hour and retest. • If it’s still serving the wrong cert after an hour, toggle to “Bring your own certificate” (BYOC) as a workaround, then back to “Azure-managed” to force a fresh DCV and cert rollout.

Consider BYOC or SKU migration • If you need a faster turnaround or more control, upload your own TLS cert into Key Vault and configure BYOC on that custom domain. • Looking ahead, Classic SKUs will lose Azure-managed cert support after 15 August 2025—so you may want to plan a migration to Front Door Standard/Premium or BYOC before then.

References

Configure HTTPS on a Front Door (classic) custom domain https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain-https

Domains in Azure Front Door: HTTPS for custom domains https://learn.microsoft.com/azure/frontdoor/domain#https-for-custom-domains

Kindly let us know if the above helps or you need further assistance on this issue.

Please “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Mike Meyers 0 Reputation points

2026-03-26T18:50:32.6966667+00:00

Hey,

Thanx for the fast response. I have run "nslookup media.orfit.com" and it says it can find the right endpoint association as you can see. So these settings should be right if I am not mistaken. I updated aswell the domain for a refresh. I can update the route aswell but all settings in here are looking good. So this should be already correct, unless you say for updating that aswell. I will wait for an hour as you suggest. The settings in the Front door are looking good aswell. Everything says "Provision succeeded" or "Enabled" in here too.

Non-authoritative answer:

media.orfit.com canonical name = orfitmedia-ax....z01.azurefd.net.

orfitmedia-ax....z01.azurefd.net canonical name = mr-z01.tm-azurefd.net.

Name: mr-z01.tm-azurefd.net