Remove-AzWebAppCertificate is slow

[klinki]

Description

Remove-AzWebAppCertificate API is extremely slow.

I run into issue with having more then 800 TLS/SSL certificates, so I checked why there are so many to discover we weren't cleaning the old expired certificates. So I created a script to clean them.

And then I found Remove-AzWebAppCertificate API is incredibly slow. Average response time was around 30 seconds. But sometimes as long as 180 and even 300 seconds.

Try to imagine deleting 800 certificates with such a speed...

Now I will use Invoke-AzRestMethod -Method DELETE -Path $Path; to delete the certificates as it is sooo much faster. But I think Remove-AzWebAppCertificate should be on par with it.

Issue script & Debug output

$resourceGroupName = '.....';
$certificates = Get-AzWebAppCertificate -ResourceGroupName $resourceGroupName
$date = Get-Date -Year 2024 -Month 02 -Day 01
$expiredCertificates = $certificates | Where-Object { $_.ExpirationDate -lt $date };

foreach ($cert in $expiredCertificates) {
    Remove-AzWebAppCertificate -ResourceGroupName $resourceGroupName -Thumbprint $cert.Thumbprint;
    Write-Output ("Removed " + $cert.Thumbprint);
}

Environment data

Name                           Value
----                           -----
PSVersion                      7.4.1
PSEdition                      Core
GitCommitId                    7.4.1
OS                             CBL-Mariner/Linux
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.15.1                Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script     7.1.1                 Az.Compute                          {Add-AzImageDataDisk, Add-AzVhd, Add-AzVMAdditionalUnattendContent, Add-AzVMDataDisk…}
Script     7.4.0                 Az.Network                          {Add-AzApplicationGatewayAuthenticationCertificate, Add-AzApplicationGatewayBackendAddressPool, Add-AzApplicationGatewayBackendHttpSetting…
Script     6.15.0                Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
Script     6.1.1                 Az.Storage                          {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementPolicyAction, Add-AzStorageAccountNetworkRule, Close-AzStorageFileHandle…
Script     1.1.3                 Az.Tools.Predictor                  {Disable-AzPredictor, Enable-AzPredictor, Open-AzPredictorSurvey, Send-AzPredictorRating}
Script     3.2.0                 Az.Websites                         {Add-AzWebAppAccessRestrictionRule, Add-AzWebAppTrafficRouting, Edit-AzWebAppBackupConfiguration, Get-AzAppServiceEnvironment…}
Script     0.0.0.10              AzureAD.Standard.Preview            {Add-AzureADApplicationOwner, Add-AzureADDeviceRegisteredOwner, Add-AzureADDeviceRegisteredUser, Add-AzureADDirectoryRoleMember…}
Script     0.9.3                 AzurePSDrive

Error output

No response

[isra-fel]

This is not a long running operation, so the extra time cannot be from polling. Also the cmdlet implementation is merely a wrapper of the HTTP request, I can't imagine a huge difference of performace between this and Invoke-AzRest.

Still I'll loop in WebApp team to share their insights.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @antcp, @AzureAppServiceCLI.