Skip to content

Commit f63b6be

Browse files
yutanglin16yutanglin16
authored
Add section to identify resources
1 parent 4f55b80 commit f63b6be

File tree

1 file changed

+105
-6
lines changed

1 file changed

+105
-6
lines changed

‎articles/app-service/app-service-managed-certificate-changes-july-2025.md

Lines changed: 105 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,112 @@ For a detailed explanation of the underlying changes at DigiCert, refer to [chan
2929
3030
## Impacted scenarios
3131

32-
You can't create or renew ASMCs if:
33-
- Your app is not publicly accessible.
34-
- You use Azure Traffic Manager with nested or external endpoints.
35-
- You rely on `*.trafficmanager.net` domains.
32+
You can't create or renew ASMCs if your:
33+
1. Site is not publicly accessible.
34+
- Public accessibility to your app is required. If your app is only accessible privately (e.g., requiring a client certificate for access, disabling public network access, using private endpoints or IP restrictions), you will not be able to create or renew a managed certificate.
35+
- Other site configurations or setup methods not explicitly listed here that restrict public access, such as firewalls, authentication gateways, or any custom access policies, can also impact eligibility for managed certificate issuance or renewal.
36+
1. Site is an Azure Traffic Manager "nested" or "external" endpoint:
37+
- Only “Azure Endpoints” on Traffic Manager will be supported for certificate creation and renewal.
38+
- “Nested endpoints” and “External endpoints” will not be supported.
39+
1. Site relies on _*.trafficmanager.net_ domains.
40+
- Certificates for _*.trafficmanager.net_ domains will not be supported for creation or renewal.
3641

3742
Existing certificates remain valid until expiration (up to 6 months), but will not renew automatically if your configuration is unsupported.
3843

44+
## Identify impacted resources
45+
You can use [Azure Resource Graph (ARG)](https://portal.azure.com/?feature.customPortal=false#view/HubsExtension/ArgQueryBlade) queries to help identify resources that may be affected under each scenario. Please note that these queries are provided as a starting point and may not capture every configuration. Review your environment for any unique setups or custom configurations.
46+
47+
### Scenario 1: Site is not publicly accessible
48+
This ARG query retrieves a list of sites that either have the public network access property disabled or are configured to use client certificates. It then filters for sites that are using App Service Managed Certificates (ASMC) for their custom hostname SSL bindings. These certificates are the ones that could be affected by the upcoming changes. However, please note that this query does not provide complete coverage, as there may be additional configurations impacting public access to your app that are not included here. Ultimately, this query serves as a helpful guide for users, but a thorough review of your environment is recommended. You can copy this query, paste it into [ARG Explorer](https://portal.azure.com/?feature.customPortal=false#view/HubsExtension/ArgQueryBlade), and then click "Run query" to view the results for your environment.
49+
50+
```kql
51+
// ARG Query: Identify App Service sites that commonly restrict public access and use ASMC for custom hostname SSL bindings
52+
resources
53+
| where type == "microsoft.web/sites"
54+
// Extract relevant properties for public access and client certificate settings
55+
| extend
56+
publicNetworkAccess = tolower(tostring(properties.publicNetworkAccess)),
57+
clientCertEnabled = tolower(tostring(properties.clientCertEnabled))
58+
// Filter for sites that either have public network access disabled
59+
// or have client certificates enabled (both can restrict public access)
60+
| where publicNetworkAccess == "disabled"
61+
or clientCertEnabled != "false"
62+
// Expand the list of SSL bindings for each site
63+
| mv-expand hostNameSslState = properties.hostNameSslStates
64+
| extend
65+
hostName = tostring(hostNameSslState.name),
66+
thumbprint = tostring(hostNameSslState.thumbprint)
67+
// Only consider custom domains (exclude default *.azurewebsites.net) and sites with an SSL certificate bound
68+
| where tolower(hostName) !endswith "azurewebsites.net" and isnotempty(thumbprint)
69+
// Select key site properties for output
70+
| project siteName = name, siteId = id, siteResourceGroup = resourceGroup, thumbprint, publicNetworkAccess, clientCertEnabled
71+
// Join with certificates to find only those using App Service Managed Certificates (ASMC)
72+
// ASMCs are identified by the presence of the "canonicalName" property
73+
| join kind=inner (
74+
resources
75+
| where type == "microsoft.web/certificates"
76+
| extend
77+
certThumbprint = tostring(properties.thumbprint),
78+
canonicalName = tostring(properties.canonicalName) // Only ASMC uses the "canonicalName" property
79+
| where isnotempty(canonicalName)
80+
| project certName = name, certId = id, certResourceGroup = tostring(properties.resourceGroup), certExpiration = properties.expirationDate, certThumbprint, canonicalName
81+
) on $left.thumbprint == $right.certThumbprint
82+
// Final output: sites with restricted public access and using ASMC for custom hostname SSL bindings
83+
| project siteName, siteId, siteResourceGroup, publicNetworkAccess, clientCertEnabled, thumbprint, certName, certId, certResourceGroup, certExpiration, canonicalName
84+
```
85+
86+
87+
### Scenario 2: Site is an Azure Traffic Manager "nested" or "external" endpoint
88+
If your App Service uses custom domains routed through **Azure Traffic Manager**, you may be impacted if your profile includes **external** or **nested endpoints**. These endpoint types are not supported for certificate issuance or renewal under the new validation.
89+
90+
To help identify affected Traffic Manager profiles across your subscriptions, we recommend using [this PowerShell script](https://github.com/nimccoll/NonAzureTrafficManagerEndpoints) developed by the Microsoft team. It scans for profiles with non-Azure endpoints and outputs a list of potentially impacted resources.
91+
92+
> [!NOTE]
93+
> You need at least Reader access to all subscriptions to run the script successfully.
94+
>
95+
96+
To run the script:
97+
1. Download the [Powershell script from GitHub](https://github.com/nimccoll/NonAzureTrafficManagerEndpoints).
98+
1. Open PowerShell and navigate to the script location.
99+
1. Run the script.
100+
```
101+
.\TrafficManagerNonAzureEndpoints.ps1
102+
```
103+
104+
### Scenario 3: Site relies on _*.trafficmanager.net_ domains
105+
This ARG query helps you identify App Service Managed Certificates (ASMC) that were issued to _*.trafficmanager.net domains_. In addition, it also checks whether any web apps are currently using those certificates for custom domain SSL bindings. You can copy this query, paste it into [ARG Explorer](https://portal.azure.com/?feature.customPortal=false#view/HubsExtension/ArgQueryBlade), and then click "Run query" to view the results for your environment.
106+
107+
```kql
108+
// ARG Query: Identify App Service Managed Certificates (ASMC) issued to *.trafficmanager.net domains
109+
// Also checks if any web apps are currently using those certificates for custom domain SSL bindings
110+
resources
111+
| where type == "microsoft.web/certificates"
112+
// Extract the certificate thumbprint and canonicalName (ASMCs have a canonicalName property)
113+
| extend
114+
certThumbprint = tostring(properties.thumbprint),
115+
canonicalName = tostring(properties.canonicalName) // Only ASMC uses the "canonicalName" property
116+
// Filter for certificates issued to *.trafficmanager.net domains
117+
| where canonicalName endswith "trafficmanager.net"
118+
// Select key certificate properties for output
119+
| project certName = name, certId = id, certResourceGroup = tostring(properties.resourceGroup), certExpiration = properties.expirationDate, certThumbprint, canonicalName
120+
// Join with web apps to see if any are using these certificates for SSL bindings
121+
| join kind=leftouter (
122+
resources
123+
| where type == "microsoft.web/sites"
124+
// Expand the list of SSL bindings for each site
125+
| mv-expand hostNameSslState = properties.hostNameSslStates
126+
| extend
127+
hostName = tostring(hostNameSslState.name),
128+
thumbprint = tostring(hostNameSslState.thumbprint)
129+
// Only consider bindings for *.trafficmanager.net custom domains with a certificate bound
130+
| where tolower(hostName) endswith "trafficmanager.net" and isnotempty(thumbprint)
131+
// Select key site properties for output
132+
| project siteName = name, siteId = id, siteResourceGroup = resourceGroup, thumbprint
133+
) on $left.certThumbprint == $right.thumbprint
134+
// Final output: ASMCs for *.trafficmanager.net domains and any web apps using them
135+
| project certName, certId, certResourceGroup, certExpiration, canonicalName, siteName, siteId, siteResourceGroup
136+
```
137+
39138
## Mitigation guidance
40139

41140
### Scenario 1: Site is not publicly accessible
@@ -91,7 +190,7 @@ Some customers may choose to allowlist [DigiCert’s domain validation IPs](http
91190
For guidance on configuring access restrictions, refer to [set up Azure App Service access restrictions](app-service-ip-restrictions.md).
92191

93192

94-
### Scenario 2: Azure Traffic Manager with nested or external endpoints
193+
### Scenario 2: Site is an Azure Traffic Manager "nested" or "external" endpoint
95194

96195
Only “Azure Endpoints” are supported. “Nested” and “External” endpoints are not supported for ASMC validation.
97196

@@ -101,7 +200,7 @@ Only “Azure Endpoints” are supported. “Nested” and “External” endpoi
101200
- For guidance on using App Service as an Azure Traffic Manager endpoint, refer to [App Service and Traffic Manager Profiles](web-sites-traffic-manager.md#app-service-and-traffic-manager-profiles).
102201

103202

104-
### Scenario 3: Use of trafficmanager.net domains
203+
### Scenario 3: Site relies on _*.trafficmanager.net_ domains
105204

106205
Certificates for `*.trafficmanager.net` domains are not supported. If your app relies on this domain and uses ASMC, you need to remove that dependency and secure your app using a custom domain and certificate.
107206

0 commit comments

Comments
 (0)