title: Assign/import/issue an auto-renewed App Service Certificate in Azure?
body: <p>I have an App Service Certificate in Azure that is set to auto renew. When I try to import it into the associated App Service, however, I get the error:</p>
  <blockquote>
  <p>App Service Certificate is not issued.</p>
  </blockquote>
  <p>How do I “issue” an App Service Certificate so that it can be assigned to an App Service via import?</p>
  <h1>App Service Certificate Configuration</h1>
  <p>To verify the status of the App Service Certificate, I did the following:</p>
  <ol>
  <li>Open the “App Service Certificate” under “All Resources”</li>
  <li>Click “Certificate Expired” warning (or, alternatively, “Certificate Configuration”)</li>
  <li>Confirmed “Certificate successfully imported to Key Vault” (checked)</li>
  <li>Confirmed “Domain ownership verified” (checked)</li>
  <li>Confirmed “Certificate ready to use in App Service”</li>
  <li>Followed instructions under “Step 3: Assign”</li>
  </ol>
  <h1>App Service Certificate Assignment</h1>
  <p>To assign the App Service Certificate, I followed the instructions under the Certificate Status’s “Step 3: Assign” window. This is similar to the instructions on Microsoft’s <a href="https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site#verify-domain-ownership" rel="nofollow noreferrer">Buy SSL Cert</a> page.</p>
  <ol>
  <li>Open the “App Service” under “All Resources”</li>
  <li>Click “TSL/SSL Settings”</li>
  <li>Click “Private Key Certificates (.pfx)”</li>
  <li>Click “Import App Service Certificate”</li>
  <li>Click the App Service Certificate (it shows up as expected)</li>
  <li>Receive error, “App Service Certificate is not issued.”</li>
  </ol>
  <blockquote>
  <p><strong>Note:</strong> The steps above are slightly different than those in the “Certificate Status” page due to changes in the Azure Portal user interface. E.g., “Custom domains and SSL” has been renamed to “TSL/SSL Settings”, and “Certificates” has been renamed to “Private Key Certificates (.pfx)”.</p>
  </blockquote>
  <h1>Other Information</h1>
  <p>As part of troubleshooting this process, I also verified the following:</p>
  <ol>
  <li>The certificate is currently marked as expired</li>
  <li>“Auto Renew App Service Certificate” is set to “On”</li>
  <li>“Manual renewal not allowed at this time… to prevent accidental renewal”</li>
  <li>“Rekey is not allowed” since the certificate is not in an issued state</li>
  <li>While “Step 3: Assign” reports “Certificate ready to use in App Service”, that step is not checked—presumably because it hasn’t been assigned.</li>
  </ol>
  <blockquote>
  <p><strong>Note:</strong> I went through this process last year with this same Subscription, App Service, and App Service Certificate without a problem.</p>
  </blockquote>
  <h1>Analysis</h1>
  <p>The “Step 3: Assign” instructions state “completing all the steps will get the certificate to the Issued state”. It then goes on to say, “An issued App Service certificate may be used on any App Service Web App”. There seems to be a missing step between these, however, as while it reports that “Certificate ready to use in App Service”, the App Service states that the “App Service Certificate is not issued”. How do I get the App Service Certificate to an “Issued” state?</p>