Can't add TLS/SSL binding to custom domain

Question

Can't add TLS/SSL binding to custom domain

Eric P 5

I've added a custom domain to a web app (which included a verification step, which looked for CNAME and TXT records, which passed), but adding the binding to the custom domain fails with "Hostname not eligible for App Service Managed Certificates creation. Ensure that your domain foo.example.com has an active CNAME record which is set to example-foo-web.azurewebsites.net."

I'm 100% sure the CNAME exists and is correct, confirmed by https://www.digwebinterface.com/

When I click to troubleshoot, the Reason for Failure is "Certificate import failure needs more investigation" and the Recommended Action is "Please create a support ticket and provide this Correlation Id : ABC123..."

DNS occasionally takes some time, but it's been about 6 hours.

What are my next steps here?

Aditya N 2,455 Reputation points Microsoft External Staff Moderator

2026-04-06T02:30:25.68+00:00

Hello @Eric P

Thank you for reaching out Microsoft Q&A.

nslookup -type=TXT <domain.com>
Could you please check and let us know the outcome for your domain.

Also please could you provide your domain details in private message.

Eric P 5

Hi, see below (domain example and subdomain foo swapped in, will PM you domain details):

C:\Users\Username>nslookup -type=TXT foo.example.com
Server:  SecurityGateway4P
Address:  192.168.150.1
Non-authoritative answer:
foo.example.com       canonical name = example-foo-web.azurewebsites.net
example-foo-web.azurewebsites.net    canonical name = waws-prod-mwh-039.sip.azurewebsites.windows.net
waws-prod-mwh-039.sip.azurewebsites.windows.net canonical name = waws-prod-mwh-039.westus2.cloudapp.azure.com
westus2.cloudapp.azure.com
        primary name server = ns1-02.azure-dns.com
        responsible mail addr = msnhst.microsoft.com
        serial  = 1
        refresh = 900 (15 mins)
        retry   = 300 (5 mins)
        expire  = 604800 (7 days)
        default TTL = 60 (1 min)