trafficmanager.net certificate renewal unavailable - is this certificate needed?

Question

trafficmanager.net certificate renewal unavailable - is this certificate needed?

Simple Med 0

My service is complaining that it cannot renew the trafficmanager.net certificate.

cert_renew

Looking about for suggested solutions, it recommends creating a custom endpoint. Which already exists, and has a functioning managed certificate.

The CNAME in the DNS for the custom (myapi.*) is currently pointing at the trafficmanager.net endpoint.

It looks like the traffic manager is supposed to route requests directly through to the final end point, and therefore will use the custom domain certificate. This appears to be the case when I examine which SSL certificate is returned in the browser.

The question is: IS the trafficmanager.net certificate used? And do I need to set up another custom endpoint to manage it?

Note: Traffic manager profile is tagged as degraded ... is this related?

Simple Med 0 Reputation points

2026-08-17T01:12:40.5566667+00:00

To be clear: do I need to add ANOTHER custom domain just for trafficmanager.net, IN ADDITION to the existing custom domain, IF were are only using the custom domain for access?

Answer accepted by question author

0 additional answers

Your answer

Simple Med 0 Reputation points

2026-08-17T01:12:40.5566667+00:00

To be clear: do I need to add ANOTHER custom domain just for trafficmanager.net, IN ADDITION to the existing custom domain, IF were are only using the custom domain for access?

Answer 1

Azure Traffic Manager operates purely at the DNS level and never terminates TLS traffic or sees certificates. Effectively, the trafficmanager.net certificate is not used by browsers connecting to your custom domain and, by implication, the degraded status is directly related to why your renewal or monitoring is failing.

Traffic Manager only returns DNS records that direct clients to your backend endpoints. The TLS certificate presented to the browser comes directly from the underlying backend endpoint, such as an Azure App Service.

You do not need a separate custom endpoint just for trafficmanager.net. The warning is likely caused by an old or orphaned certificate binding associated with a *.trafficmanager.net hostname or by an invalid validation configuration. You only need the managed certificate for your actual custom domain, such as your myapi.*, bound to the backend resource.

A Degraded profile means that its health probes are failing. Certificate authorities such as DigiCert may also rely on public HTTP validation or reachability checks. If Traffic Manager or the backend blocks port 80 or 443, or if the health probe is incorrectly configured, such as probing HTTP instead of HTTPS on port 443, certificate renewal validation can fail while the Traffic Manager profile remains degraded.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Simple Med 0 Reputation points

2026-08-17T01:52:55.08+00:00

Thanks. That appears to be pretty much what is happening.