Merge pull request #297359 from greg-lindsay/appgw-upd

Renewing cert doesn't incur downtime

Author: prmerger-automator[bot]

articles/application-gateway/renew-certificates.md

@@ -3,17 +3,16 @@ title: Renew an Azure Application Gateway certificate
 description: Learn how to renew a certificate associated with an application gateway listener.
 services: application-gateway
 author: greg-lindsay
-
 ms.service: azure-application-gateway
 ms.topic: how-to
-ms.date: 01/25/2022
+ms.date: 03/31/2025
 ms.author: greglin 
 ms.devlang: azurecli
 ---
 
 # Renew Application Gateway certificates
 
-At some point, you'll need to renew your certificates if you configured your application gateway for TLS/SSL encryption.
+At some point, you'll need to renew your certificates if you configured your application gateway for TLS/SSL encryption. When you renew an SSL certificate with a valid new certificate, this doesn't incur any downtime for the service.
 
 There are two locations where certificates may exist: certificates stored in Azure Key Vault, or certificates uploaded to an application gateway.
 
@@ -22,9 +21,9 @@ There are two locations where certificates may exist: certificates stored in Azu
 When Application Gateway is configured to use Key Vault certificates, its instances retrieve the certificate from Key Vault and install them locally for TLS termination. The instances poll Key Vault at four-hour intervals to retrieve a renewed version of the certificate if it exists. If an updated certificate is found, the TLS/SSL certificate that's currently associated with the HTTPS listener is automatically rotated.
 
 > [!TIP]
-> Any change to Application Gateway will force a check against Key Vault to see if any new versions of certificates are available. This includes, but is not limited to, changes to Frontend IP Configurations, Listeners, Rules, Backend Pools, Resource Tags, and more. If an updated certificate is found, the new certificate will immediately be presented.
+> Any change to Application Gateway forces a check against Key Vault to see if any new versions of certificates are available. This includes, but is not limited to, changes to Frontend IP Configurations, Listeners, Rules, Backend Pools, Resource Tags, and more. If an updated certificate is found, the new certificate is immediately presented.
 
-Application Gateway uses a secret identifier in Key Vault to reference the certificates. For Azure PowerShell, the Azure CLI, or Azure Resource Manager, we strongly recommend that you use a secret identifier that doesn't specify a version. This way, Application Gateway will automatically rotate the certificate if a newer version is available in your key vault. An example of a secret URI without a version is `https://myvault.vault.azure.net/secrets/mysecret/`.
+Application Gateway uses a secret identifier in Key Vault to reference the certificates. For Azure PowerShell, the Azure CLI, or Azure Resource Manager, we strongly recommend that you use a secret identifier that doesn't specify a version. This way, Application Gateway automatically rotates the certificate if a newer version is available in your key vault. An example of a secret URI without a version is `https://myvault.vault.azure.net/secrets/mysecret/`.
 
 ## Certificates on an application gateway