Merge pull request #77235 from jaszperez/patch-44

pki restriction

Author: PRMerger9

articles/active-directory/manage-apps/application-proxy-configure-custom-domain.md

@@ -68,7 +68,9 @@ When you have those three requirements ready, follow these steps to set up your
 ### Certificate format
 There is no restriction on the certificate signature methods. Elliptic Curve Cryptography (ECC), Subject Alternative Name (SAN), and other common certificate types are all supported. 
 
-You can use a wildcard certificate as long as the wildcard matches the desired external URL. 
+You can use a wildcard certificate as long as the wildcard matches the desired external URL.
+
+You cannot use a certificate issued by your own public key infrastructure (PKI) due to security considerations.
 
 ### Changing the domain
 All verified domains appear in the External URL dropdown list for your application. To change the domain, just update that field for the application. If the domain you want isn't in the list, [add it as a verified domain](../fundamentals/add-custom-domain.md). If you select a domain that doesn't have an associated certificate yet, follow steps 5-7 to add the certificate. Then, make sure you update the DNS record to redirect from the new external URL.