You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/app-service-managed-certificate-changes-july-2025.md
+109-9Lines changed: 109 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,18 +29,118 @@ For a detailed explanation of the underlying changes at DigiCert, refer to [chan
29
29
30
30
## Impacted scenarios
31
31
32
-
You can't create or renew ASMCs if:
33
-
-Your app is not publicly accessible.
34
-
- You use Azure Traffic Manager with nested or external endpoints.
35
-
- You rely on `*.trafficmanager.net` domains.
32
+
You can't create or renew ASMCs if your:
33
+
-Site is not publicly accessible:
34
+
- Public accessibility to your app is required. If your app is only accessible through private configurations, such as requiring a client certificate, disabling public network access, using private endpoints, or applying IP restrictions, you can't create or renew a managed certificate.
35
+
- Other configurations that restrict public access, such as firewalls, authentication gateways, or custom access policies, may also affect eligibility for managed certificate issuance or renewal.
36
36
37
-
Existing certificates remain valid until expiration (up to 6 months), but will not renew automatically if your configuration is unsupported.
37
+
- Site is an Azure Traffic Manager "nested" or "external" endpoint:
38
+
- Only "Azure Endpoints" on Traffic Manager is supported for certificate creation and renewal.
39
+
- "Nested endpoints" and "External endpoints" is not supported.
40
+
- Site relies on _*.trafficmanager.net_ domains:
41
+
- Certificates for _*.trafficmanager.net_ domains is not supported for creation or renewal.
42
+
43
+
Existing certificates remain valid until expiration (up to six months), but will not renew automatically if your configuration is unsupported.
44
+
45
+
## Identify impacted resources
46
+
You can use [Azure Resource Graph (ARG)](https://portal.azure.com/?feature.customPortal=false#view/HubsExtension/ArgQueryBlade) queries to help identify resources that may be affected under each scenario. These queries are provided as a starting point and may not capture every configuration. Review your environment for any unique setups or custom configurations.
47
+
48
+
### Scenario 1: Site is not publicly accessible
49
+
This ARG query retrieves a list of sites that either have the public network access property disabled or are configured to use client certificates. It then filters for sites that are using App Service Managed Certificates (ASMC) for their custom hostname SSL bindings. These certificates are the ones that could be affected by the upcoming changes. However, this query does not provide complete coverage, as there may be other configurations impacting public access to your app that are not included here. Ultimately, this query serves as a helpful guide for users, but a thorough review of your environment is recommended. You can copy this query, paste it into [ARG Explorer](https://portal.azure.com/?feature.customPortal=false#view/HubsExtension/ArgQueryBlade), and then click "Run query" to view the results for your environment.
50
+
51
+
```kql
52
+
// ARG Query: Identify App Service sites that commonly restrict public access and use ASMC for custom hostname SSL bindings
53
+
resources
54
+
| where type == "microsoft.web/sites"
55
+
// Extract relevant properties for public access and client certificate settings
### Scenario 2: Site is an Azure Traffic Manager "nested" or "external" endpoint
89
+
If your App Service uses custom domains routed through **Azure Traffic Manager**, you may be impacted if your profile includes **external** or **nested endpoints**. These endpoint types are not supported for certificate issuance or renewal under the new validation.
90
+
91
+
To help identify affected Traffic Manager profiles across your subscriptions, we recommend using [this PowerShell script](https://github.com/nimccoll/NonAzureTrafficManagerEndpoints) developed by the Microsoft team. It scans for profiles with non-Azure endpoints and outputs a list of potentially impacted resources.
92
+
93
+
> [!NOTE]
94
+
> You need at least Reader access to all subscriptions to run the script successfully.
95
+
>
96
+
97
+
To run the script:
98
+
1. Download the [PowerShell script from GitHub](https://github.com/nimccoll/NonAzureTrafficManagerEndpoints).
99
+
1. Open PowerShell and navigate to the script location.
100
+
1. Run the script.
101
+
```
102
+
.\TrafficManagerNonAzureEndpoints.ps1
103
+
```
104
+
105
+
### Scenario 3: Site relies on _*.trafficmanager.net_ domains
106
+
This ARG query helps you identify App Service Managed Certificates (ASMC) that were issued to _*.trafficmanager.net domains_. In addition, it also checks whether any web apps are currently using those certificates for custom domain SSL bindings. You can copy this query, paste it into [ARG Explorer](https://portal.azure.com/?feature.customPortal=false#view/HubsExtension/ArgQueryBlade), and then click "Run query" to view the results for your environment.
107
+
108
+
```kql
109
+
// ARG Query: Identify App Service Managed Certificates (ASMC) issued to *.trafficmanager.net domains
110
+
// Also checks if any web apps are currently using those certificates for custom domain SSL bindings
111
+
resources
112
+
| where type == "microsoft.web/certificates"
113
+
// Extract the certificate thumbprint and canonicalName (ASMCs have a canonicalName property)
114
+
| extend
115
+
certThumbprint = tostring(properties.thumbprint),
116
+
canonicalName = tostring(properties.canonicalName) // Only ASMC uses the "canonicalName" property
117
+
// Filter for certificates issued to *.trafficmanager.net domains
118
+
| where canonicalName endswith "trafficmanager.net"
Apps that are not accessible from the public internet will not be able to create or renew ASMCs. This includes restrictions via private endpoints, firewalls, IP restrictions, client certificates, authentication gateways, or custom access policies.
143
+
Apps that are not accessible from the public internet cannot create or renew ASMCs. These configurations may include restrictions enforced through private endpoints, firewalls, IP filtering, client certificates, authentication gateways, or custom access policies.
44
144
45
145
We recognize that making applications publicly accessible may conflict with customer security policies or introduce risk. The recommended mitigation is to replace ASMC with a custom certificate and update the TLS/SSL binding for your custom domain.
46
146
@@ -91,17 +191,17 @@ Some customers may choose to allowlist [DigiCert’s domain validation IPs](http
91
191
For guidance on configuring access restrictions, refer to [set up Azure App Service access restrictions](app-service-ip-restrictions.md).
92
192
93
193
94
-
### Scenario 2: Azure Traffic Manager with nested or external endpoints
194
+
### Scenario 2: Site is an Azure Traffic Manager "nested" or "external" endpoint
95
195
96
-
Only “Azure Endpoints” are supported. “Nested” and “External” endpoints are not supported for ASMC validation.
196
+
Only "Azure Endpoints" are supported. "Nested" and "External" endpoints are not supported for ASMC validation.
97
197
98
198
**Recommended mitigation:**
99
199
100
200
- Switch to Azure Endpoints or use a custom domain secured with a custom certificate.
101
201
- For guidance on using App Service as an Azure Traffic Manager endpoint, refer to [App Service and Traffic Manager Profiles](web-sites-traffic-manager.md#app-service-and-traffic-manager-profiles).
102
202
103
203
104
-
### Scenario 3: Use of trafficmanager.net domains
204
+
### Scenario 3: Site relies on _*.trafficmanager.net_ domains
105
205
106
206
Certificates for `*.trafficmanager.net` domains are not supported. If your app relies on this domain and uses ASMC, you need to remove that dependency and secure your app using a custom domain and certificate.
Key Vault Secret Refresh | [GA](./reference-dotnet-provider.md#key-vault-secret-refresh) | WIP | GA | WIP | WIP | GA
60
60
Custom Key Vault Secret Resolution | [GA](./reference-dotnet-provider.md#key-vault-reference) | GA | GA | GA | [GA](./reference-javascript-provider.md#key-vault-reference) | GA
Feature Flags | [GA](./reference-dotnet-provider.md#feature-flag) | GA | GA | GA | [GA](./reference-javascript-provider.md#feature-flag) | WIP
63
-
Variant Feature Flags | [GA](./reference-dotnet-provider.md#feature-flag) | GA | GA | GA | [GA](./reference-javascript-provider.md#feature-flag) | WIP
62
+
Feature Flags | [GA](./reference-dotnet-provider.md#feature-flag) | GA | GA | GA | [GA](./reference-javascript-provider.md#feature-flag) | GA
63
+
Variant Feature Flags | [GA](./reference-dotnet-provider.md#feature-flag) | GA | GA | GA | [GA](./reference-javascript-provider.md#feature-flag) | GA
64
64
Feature Flag Telemetry | GA | GA | WIP | GA | GA | WIP
65
65
Key Prefix Trim | [GA](./reference-dotnet-provider.md#trim-prefix-from-keys) | GA | GA | GA | [GA](./reference-javascript-provider.md#trim-prefix-from-keys) | GA
Time Window Filter | [GA](./feature-management-dotnet-reference.md#microsofttimewindow) | GA | [GA](./feature-management-python-reference.md#microsofttimewindow) | [GA](./feature-management-javascript-reference.md#microsofttimewindow) | GA
47
+
Recurring Time Window | [GA](./feature-management-dotnet-reference.md#microsofttimewindow) | GA | WIP | WIP | WIP
48
+
Custom Feature Filter | [GA](./feature-management-dotnet-reference.md#implementing-a-feature-filter) | GA | [GA](./feature-management-python-reference.md#implementing-a-feature-filter) | [GA](./feature-management-javascript-reference.md#implementing-a-feature-filter) | GA
49
+
Feature Filter Requirement Type (AND/OR) | [GA](./feature-management-dotnet-reference.md#requirement-type) | GA | [GA](./feature-management-python-reference.md#requirement-type) | [GA](./feature-management-javascript-reference.md#requirement-type) | GA
50
+
Variant Feature Flag | [GA](./feature-management-dotnet-reference.md#variants) | GA | [GA](./feature-management-python-reference.md#variants) | [GA](./feature-management-javascript-reference.md#variants) | WIP
51
+
Feature Flag Telemetry | [GA](./feature-management-dotnet-reference.md#telemetry) | GA | [GA](./feature-management-python-reference.md#telemetry) | [GA](./feature-management-javascript-reference.md#telemetry) | WIP
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments