Initial check-in...

Author: WodansSon

internal/services/cdn/cdn_frontdoor_custom_domain_resource.go

@@ -720,10 +720,6 @@ func frontDoorCustomDomainHostNameCustomizeDiff(_ context.Context, diff *plugins
 		return errors.New("`host_name` cannot be longer than 64 characters when `tls.certificate_type` is `ManagedCertificate`")
 	}
 
-	if strings.HasPrefix(hostName, "*.") {
-		return errors.New("`host_name` cannot be a wildcard domain when `tls.certificate_type` is `ManagedCertificate`")
-	}
-
 	return nil
 }
 

internal/services/cdn/cdn_frontdoor_custom_domain_resource_test.go

@@ -157,7 +157,7 @@ func TestAccCdnFrontDoorCustomDomain_cipherSuites_validation(t *testing.T) {
 	data.ResourceTest(t, r, testSteps)
 }
 
-func TestAccCdnFrontDoorCustomDomain_managedCertificate_validation(t *testing.T) {
+func TestAccCdnFrontDoorCustomDomain_managedCertificate_hostNameConstraints(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_cdn_frontdoor_custom_domain", "test")
 	r := CdnFrontDoorCustomDomainResource{}
 	r.preCheck(t)
@@ -168,9 +168,12 @@ func TestAccCdnFrontDoorCustomDomain_managedCertificate_validation(t *testing.T)
 			ExpectError: regexp.MustCompile("`host_name` cannot be longer than 64 characters when `tls\\.certificate_type` is `ManagedCertificate`"),
 		},
 		{
-			Config:      r.managedCertificateWildcardDomain(data),
-			ExpectError: regexp.MustCompile("`host_name` cannot be a wildcard domain when `tls\\.certificate_type` is `ManagedCertificate`"),
+			Config: r.managedCertificateWildcardDomain(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
 		},
+		data.ImportStep(),
 	})
 }
 
@@ -880,5 +883,5 @@ resource "azurerm_cdn_frontdoor_custom_domain" "test" {
     minimum_version  = "TLS12"
   }
 }
-`, r.validationTemplate(data), data.RandomInteger)
+`, r.template(data), data.RandomInteger)
 }

website/docs/r/cdn_frontdoor_custom_domain.html.markdown

@@ -176,7 +176,7 @@ A `tls` block supports the following:
 
 -> **Note:** It may take up to 15 minutes for the Front Door Service to validate the state and domain ownership of the Custom Domain.
 
-~> **Note:** When `certificate_type` is `ManagedCertificate`, `host_name` must not exceed 64 characters. Azure Front Door supports managed certificates for apex domains, but apex-domain certificate rotation can require revalidation of domain ownership. Wildcard domains require `CustomerCertificate`. Use `CustomerCertificate` for wildcard domains or host names longer than 64 characters.
+~> **Note:** When `certificate_type` is `ManagedCertificate`, `host_name` must not exceed 64 characters. Azure Front Door supports managed certificates for apex and wildcard domains, but apex-domain certificate rotation can require revalidation of domain ownership and wildcard-domain managed certificates are not rotated automatically.
 
 * `cipher_suite` - (Optional) A `cipher_suite` block as defined below.