Hi @ghjklw thanks for opening this issue. Per the information provided, I assume that the error is reported by resource azurerm_container_app_environment_certificate, correct? If so, I assume that this is by design because the Rest API corresponding to "azurerm_container_app_environment_certificate" is Certificates, and manually trigger the creation of a managed certificate and bind it in Azure Portal in step3, the created managed certificate corresponding Rest API is ManagedCertificates.As far as I know, currently, Terraform does not have resources to support the ManagedCertificates API.

Hi @sinbai,

Thanks for looking into it! No I am not using this resource at all, only azurerm_container_app_custom_domain. If I'm not mistaken, the whole point of #25356 was to be able to use Azure Managed Certificates, and I did apply ignore_changes = [certificate_binding_type, container_app_environment_certificate_id] as explicitly mentioned in the documentation.

Hi @ghjklw and @sinbai,

I'm seeing the same issue. It would be great to know if the manual step of creating the managed certificate is by design, or if it is supposed to be created automatically on the first deployment - and if so, if it is normal for it to take some time?

I'll note that the test added in #25356 only checks for the existence of the domain, not whether the certificate is set up properly.

I confirm the behaviour described above, in opposite to what's written in the documentation:

"Omit this value (container_app_environment_certificate_id) if you wish to use an Azure Managed certificate. You must create the relevant DNS verification steps before this process will be successful."

The managed certificate does never get created by Terraform, even though all DNS verification steps are run before.

It's useless having to generate the certificate through the portal afterwards in a fully automated infra-as-code environment as where Terraform is supposed to help with.

I'm getting this error too. Does anyone have a work around, other than not using managed certificates?

I'm getting this error too. Does anyone have a work around, other than not using managed certificates?

Our workaround is using the AzAPI provider to create both the Container App and Managed Certificate. Unfortunately, due to technical constraints on both the actual Azure API and the AzAPI provider itself, we must:

1. Create the Container App first, with Custom Domain/s configured and bound to temporary self-signed certificate/s
2. Create the Managed Certificate/s (requires Custom Domain/s to be there in advance - see point 1)
3. Update the Container App to edit the Custom Domain/s and bind them to the Managed Certificate/s.

Note that azapi_update_resource requires to pass the entire JSON body of the Container App configuration again, so it won't definitely be nice as you'll have duplicated code to maintain.

@fabrideci Yikes, thanks for that. This isn't ideal.

I've had success using a local-exec provisioner to run a bash script which calls out to azcli to provision the managed cert and bind it to the domain for me.

To bind the custom domain to the container app, use the following command:
az containerapp hostname add -g <resource_group> -n <container_app_name> --hostname <custom_domain>
This will bind the hostname to the app without requiring a certificate to do so.

Then to create a managed certificate:
az containerapp env certificate create -g <resource_group> -n <container_app_env_name> --hostname <custom_domain> --validation-method CNAME You can change the validation method to your preference.

And finally to bind the cert to the domain (providing the domain is already bound to the container app):
az containerapp hostname bind -g <resource_group> -n <container_app_name> --hostname <custom_domain> --environment <container_app_env_name> --certificate <certificate_name>

I've set my script up to work for adding/removing custom domains on already deployed container apps, here's a link to the gist if anyone is curious: https://gist.github.com/LynnAU/131426847d2793c76e36548f9937f966
The nice part about the script is, it will bind the custom domain to the container app if it's not already, import an existing managed certificate if one exists, and exit if the managed certificate is already bound.

@LynnAU Wow, thanks. That's very helpful.

Hi @ghjklw I have submitted PR to fix this issue. Could you please track it for more updates?

This is a blocking issue for me too. I used a manual binding using the portal and now my Terraform scripts are failing. Is there a workaround available to be able to run the scripts, while using the manual binding to the custom domain?

Edited -> After trying out the manual "az containerapp" way described by @LynnAU to add the certificate and binding, it works. Somehow terraform does not recognizes that new certificate and binding as something to destroy on the next "terraform apply".