Artifact Signing serves expired certificate even though profile shows a new Active certificate

R M 0 Reputation points
2026-10-23T16:38:04.5166667+00:00

Since 10/19/2026, every signing request on my Artifact Signing account fails with "The certificate is expired" / "Failed to sign. Attempts exceeded."

Setup:

  • Account in East US, Basic tier, endpoint https://eus.codesigning.azure.net
  • One Public Trust certificate profile, status Active
  • Identity validation: Completed, valid until 6/19/2027
  • Sign tool 0.9.1-beta.26475.3 (latest), Azure CLI auth

What I see:

  • The profile's certificate list shows a NEW Active certificate created 10/23/2026 (expires 10/26/2026). All older ones show Expired.
  • But the signing service still hands out the OLD certificate valid 10/16/2026 7:07 AM to 10/19/2026 7:07 AM (PDT). The sign tool's trace log shows exactly those Not Before / Not After dates, then fails.
  • The sign/certchain endpoint (api-version 2022-06-15-preview) also returns the 10/16 to 10/19 certificate.
  • No certificate was issued between 10/16 and 10/23, so daily rotation looks stuck.

Already checked: correct endpoint and region, latest sign tool, CLI login works, identity validation Completed, profile Active.

Question: how do I get the signing service to use the current Active certificate? I do not want to delete and recreate the profile. Is this a known rotation issue that needs a backend fix?

Artifact Signing
Artifact Signing

A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Zoha Fatima 675 Reputation points
    2026-10-27T17:28:28.74+00:00

    Hi R M,

    Since both the signing trace and certificate-chain endpoint return an expired certificate while the portal shows a new Active certificate, this suggests a possible backend certificate-rotation issue.

    Please open an Azure Support ticket and ask the Artifact Signing engineering team to investigate certificate selection and refresh the service state. Include the failed operation ID, certificate validity dates, region, and relevant logs.

    Avoid recreating the profile until Microsoft investigates.

    Reference: https://learn.microsoft.com/en-us/azure/artifact-signing/faq

    Thank you, and feel free to respond back for more assistance.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.