Azure Cert Gen Times Out

Logs:

~/d/d/portal ❯❯❯ defang --stack=azptest1 cert generate                                                  azure
 * Using the "azptest1" stack on azure from --stack flag and local stack file
Configure DNS records for auth.azptest1.gnafed.click:
  CNAME  auth.azptest1.gnafed.click              ->  auth.ambitioustree-8e32bb0d.westus.azurecontainerapps.io
  TXT    asuid.auth.azptest1.gnafed.click        ->  5D6889260CC6A245483E7067381B18538309AC27B21A1C49A136189C7BC093AE
 * Waiting for DNS propagation (timeout 30m0s)...
 * DNS records for auth.azptest1.gnafed.click verified
 * Registering custom hostname auth.azptest1.gnafed.click on container app auth
 * Issuing managed certificate mc-defang-portal-a-auth-azptest1-gnafed-click (this may take up to ~5 minutes)
 * Binding cert to auth.azptest1.gnafed.click on auth
 * Waiting for TLS to come online on https://auth.azptest1.gnafed.click/
Cert issuance for auth.azptest1.gnafed.click failed: timed out waiting for TLS certificate to come online
Configure DNS records for graphql.azptest1.gnafed.click:
  CNAME  graphql.azptest1.gnafed.click              ->  hasura.ambitioustree-8e32bb0d.westus.azurecontainerapps.io
  TXT    asuid.graphql.azptest1.gnafed.click        ->  5D6889260CC6A245483E7067381B18538309AC27B21A1C49A136189C7BC093AE
 * Waiting for DNS propagation (timeout 30m0s)...
Cert issuance for graphql.azptest1.gnafed.click failed: timed out after 30m0s waiting for DNS records on graphql.azptest1.gnafed.click
Configure DNS records for portal.azptest1.gnafed.click:
  CNAME  portal.azptest1.gnafed.click              ->  web.ambitioustree-8e32bb0d.westus.azurecontainerapps.io
  TXT    asuid.portal.azptest1.gnafed.click        ->  5D6889260CC6A245483E7067381B18538309AC27B21A1C49A136189C7BC093AE
 * Waiting for DNS propagation (timeout 30m0s)...
 * DNS records for portal.azptest1.gnafed.click verified
 * Registering custom hostname portal.azptest1.gnafed.click on container app web
 * Issuing managed certificate mc-defang-portal-a-portal-azptest1-gnafed-click (this may take up to ~5 minutes)
 * Binding cert to portal.azptest1.gnafed.click on web
 * Waiting for TLS to come online on https://portal.azptest1.gnafed.click/
 * TLS cert for portal.azptest1.gnafed.click is online
Configure DNS records for api.azptest1.gnafed.click:
  CNAME  api.azptest1.gnafed.click              ->  api.ambitioustree-8e32bb0d.westus.azurecontainerapps.io
  TXT    asuid.api.azptest1.gnafed.click        ->  5D6889260CC6A245483E7067381B18538309AC27B21A1C49A136189C7BC093AE
 * Waiting for DNS propagation (timeout 30m0s)...
 * DNS records for api.azptest1.gnafed.click verified
 * Registering custom hostname api.azptest1.gnafed.click on container app api
 * Issuing managed certificate mc-defang-portal-a-api-azptest1-gnafed-click (this may take up to ~5 minutes)
 * Binding cert to api.azptest1.gnafed.click on api
 * Waiting for TLS to come online on https://api.azptest1.gnafed.click/
 * TLS cert for api.azptest1.gnafed.click is online
Error: certificate issuance failed for one or more domains; verify DNS records and retry `defang cert generate`: auth.azptest1.gnafed.click: timed out waiting for TLS certificate to come online
graphql.azptest1.gnafed.click: timed out after 30m0s waiting for DNS records on graphql.azptest1.gnafed.click
~/d/d/portal ❯❯❯   

Start at the defang cert generate Azure path and reproduce the logged auth, graphql, and portal certificate flow. Compare DNS verification and TLS wait behavior for the failing domains with the domains that complete; done means certificate generation handles these Azure domains without timing out and retains clear failure reporting.