Unable to bind custom domain and create managed certificate for Azure Container App via CLI

[yveskerwyn]

I'm trying to bind a custom domain (admin.qbytes.tech) to an Azure Container App (admin) and generate a managed certificate using the Azure CLI.

Despite having correctly configured the required TXT record (asuid.admin.qbytes.tech) and confirmed its propagation globally, the CLI keeps failing with the following error:

(RequireCustomHostnameInEnvironment) Creating managed certificate requires hostname 'admin.qbytes.tech' added as a custom hostname to a container app or route in environment 'cae-xxxxxxx'

Attempts to use az containerapp hostname bind also trigger certificate creation automatically, which fails with the same error — even though the DNS validation record is publicly visible and correct.

It seems impossible to bind the domain without triggering certificate creation, and the CLI doesn’t allow separating these steps. This behavior is confusing and inconsistent with the expected flow.

Has anyone successfully managed to:

• Bind a custom domain to a Container App without triggering certificate creation?
• Create a managed certificate after domain binding via CLI?

Any working examples or official guidance would be appreciated. I’ve spent hours trying to resolve this and would love a reliable, documented solution.

[fboucher]

Great questions @yveskerwyn !
I know it won't help you fixing that specific scenario, but for me because I'm 1 user I don't really need the admin app to be in Azure. So I'm running it in a container on a server. I'm still working on implementing some login with keycloak (also running on that server)