App Service Certificates: Ongoing Obsolete Certificate Verification Warnings

Question

App Service Certificates: Ongoing Obsolete Certificate Verification Warnings

Ray-9659 0

Problem description

I am receiving daily email warnings about obsolete certificate verification for my App Service Certificates, even after moving the certificates to a different subscription and completing verification. I need help understanding why these reminders continue and how to stop them.

Environment

Azure App Service (Windows) in the context of issues with App Service Certificates.

What I've already tried

I have reviewed the case details, moved the certificate resources to a new subscription, renewed the certificates, and updated the TLS bindings. I have also confirmed that the certificates in the original subscription are no longer in use, but the reminder emails persist.

Current status

I am seeking guidance on how to identify and resolve any lingering certificate orders or notification records that may be causing these ongoing obsolete certificate verification warnings.

Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-09-22T16:04:08.2533333+00:00

Hi @Ray-9659

Thank you for reaching us regarding the issue.

We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this.
Ray Wang 5 Reputation points

2026-09-25T21:06:49.9133333+00:00

Hi @Golla Venkata Pavani

I'm the original poster (@Ray-9659), following up from a different account.

Following up on your reply from Sep 22 — the daily obsolete certificate verification warnings are still coming in, and I haven't seen the suggestions yet. Could you share a quick status update when you get a chance?

The certificates were already moved to a new subscription, renewed, and the TLS bindings updated, so these look like stale notifications from the old subscription. Happy to provide any other details that would help.

Thanks, Ray
Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-09-27T10:47:16.9133333+00:00
Hi @Ray-9659 and @Ray Wang

The daily “obsolete certificate verification” emails are generated by residual App Service Certificate orders (resource type Microsoft.CertificateRegistration/certificateOrders) that remain in the original subscription. Moving the certificate resources, renewing them, and updating TLS bindings in the new subscription does not automatically cancel the verification reminders tied to the old orders.

App Service Certificates are subscription-scoped. Domain ownership verification is required for issuance, renewal, rekey, or when the previous verification ages out. Azure continues to send verification emails for any order that stays in a pending, failed, or “domain verification required” state, even when the certificate is no longer in use.

Resolution steps:

Inspect both subscriptions for residual certificate orders

In the Azure portal, open App Service Certificates and select each certificate.

Confirm the Status is Issued (not Expired or Pending Issuance). Check the expiration date and whether Auto Renew is enabled (Certificate Configuration > Auto Renew Settings).

Go to Certificate Configuration > Step 2: Verify and verify that the message Certificate is Domain Verified appears.

Use Azure CLI or Azure Resource Explorer (https://resources.azure.com) to locate any leftover orders, especially in the original subscription:

az resource show -g <ResourceGroupName> -n <CertificateName> --resource-type Microsoft.CertificateRegistration/certificateOrders --query "properties.provisioningState"

A value such as Pendingissuance indicates incomplete domain verification. List all orders:

az resource list --subscription <subscription-id> --resource-type Microsoft.CertificateRegistration/certificateOrders

2. Complete domain verification if still required
Supported methods:

App Service verification (preferred when the custom domain is mapped to an App Service in the same subscription)

Domain verification (for App Service domains)

Mail verification

Manual verification (DNS TXT record or HTML page)

Select Verify, then Refresh until Certificate is Domain Verified appears. For renewals or rekeys, a fresh verification is required if more than 395 days have passed since the last verification; the order remains in Pending issuance until verification is finished.

Delete unused certificates and residual orders (only after confirming they are unbound)

Remove any remaining TLS/SSL bindings first. Azure blocks deletion of a certificate that is still bound.

Delete the certificate: App Service Certificates > select the certificate > Overview > Delete. Enter the certificate name to confirm. Deletion is irreversible and causes the certificate authority to revoke the certificate.

If residual certificateOrders resources appear only in Resource Explorer or CLI, delete them after confirming they are no longer needed. Also clean up associated Key Vault secrets and access policies.

Note: The certificate, its Key Vault, and the App Service that uses it must reside in the same subscription. Cross-subscription moves frequently require Azure support assistance.

While you’re there, also check Azure Advisor in both subscriptions for any domain-verification recommendations related to these certificates and dismiss/resolve them.

In the new subscription, double-check that each certificate shows Status = Issued, Certificate is Domain Verified, and that auto-renew is set the way you want.

Reference:
https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-azure-app-service-certificates
https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=rbac%2Cazure-cli%2Cportal

Kindly let us know if the above comment helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-09-28T16:41:42.39+00:00

Hi @Ray Wang

I Just want to know whether the comment above addressed your issue. If you need any further help, please let us know. We’re here to support you.
Ray Wang 5 Reputation points

2026-09-28T19:09:01.58+00:00

@Golla Venkata Pavani

Thanks. I checked the original subscription as you suggested using the Microsoft.CertificateRegistration/certificateOrders resource type.

In the original Pay-As-You-Go subscription, the certificate orders currently returned are:

myorthoevidence

mysurgicalanalytics

myoeca

There are no wildcardzenpsycom or wildcardzenpsyca certificate orders remaining in the original subscription.

However, the warning email is still being sent for the original Pay-As-You-Go subscription and specifically lists:

["wildcardzenpsycom","wildcardzenpsyca"]

Those two certificate orders are now present in the new Zenpsy subscription.

So based on the command you suggested, I do not see any lingering Zenpsy certificate orders in the original subscription. Could there still be another stale verification or notification record associated with the old subscription that is causing these emails?

1 answer

Your answer

Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-09-22T16:04:08.2533333+00:00

Hi @Ray-9659

Thank you for reaching us regarding the issue.

We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this.
Ray Wang 5 Reputation points

2026-09-25T21:06:49.9133333+00:00

Hi @Golla Venkata Pavani

I'm the original poster (@Ray-9659), following up from a different account.

Following up on your reply from Sep 22 — the daily obsolete certificate verification warnings are still coming in, and I haven't seen the suggestions yet. Could you share a quick status update when you get a chance?

The certificates were already moved to a new subscription, renewed, and the TLS bindings updated, so these look like stale notifications from the old subscription. Happy to provide any other details that would help.

Thanks, Ray
Golla Venkata Pavani 7,535 Reputation points Microsoft External Staff Moderator

2026-09-28T16:41:42.39+00:00

Hi @Ray Wang

I Just want to know whether the comment above addressed your issue. If you need any further help, please let us know. We’re here to support you.
Ray Wang 5 Reputation points

2026-09-28T19:09:01.58+00:00

@Golla Venkata Pavani

Thanks. I checked the original subscription as you suggested using the Microsoft.CertificateRegistration/certificateOrders resource type.

In the original Pay-As-You-Go subscription, the certificate orders currently returned are:

myorthoevidence

mysurgicalanalytics

myoeca

There are no wildcardzenpsycom or wildcardzenpsyca certificate orders remaining in the original subscription.

However, the warning email is still being sent for the original Pay-As-You-Go subscription and specifically lists:

["wildcardzenpsycom","wildcardzenpsyca"]

Those two certificate orders are now present in the new Zenpsy subscription.

So based on the command you suggested, I do not see any lingering Zenpsy certificate orders in the original subscription. Could there still be another stale verification or notification record associated with the old subscription that is causing these emails?

Answer 1

Salamat Shah 750 MVP

Check the original subscription for any lingering Microsoft.CertificateRegistration/certificateOrders resources and remove obsolete certificate orders after confirming they are no longer required. Microsoft recommends verifying the certificate status, renewal settings, domain verification, and bindings when troubleshooting App Service certificate issues.

https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-azure-app-service-certificates

Ray Wang 5 Reputation points

2026-09-28T19:10:04.5633333+00:00

Thanks. I checked the original subscription for Microsoft.CertificateRegistration/certificateOrders as suggested.

The only certificate orders currently present in the original Pay-As-You-Go subscription are:

myorthoevidence

mysurgicalanalytics

myoeca

There are no wildcardzenpsycom or wildcardzenpsyca certificate orders remaining in the original subscription.

However, the warning email is still being generated for the original subscription and specifically lists wildcardzenpsycom and wildcardzenpsyca.

So I do not appear to have any obsolete Zenpsy certificate orders in the original subscription to remove. Could there be another stale verification or notification record associated with the old subscription?