Azure App Service managed certificates change unclear

Question

Azure App Service managed certificates change unclear

A L 20

In the email "Upcoming policy updates will impact Azure App Service managed certificates starting 28 July 2025"

It mentions that I would need to take action if "Your app uses nested or external endpoints". External endpoints isn't a term used in the configuration of App Services, at least in the portal. The closest I can see is in the networking section "Enabled with no access restrictions", which is the default.

I don't see a product in the portal called Azure Endpoints, just Private Endpoints.

Can I get some clarification?

A L 20 Reputation points

2025-07-23T13:05:26.9533333+00:00

@Bhargavi Naragani Thank you, that was the answer I was looking for!
Giglioli, Andre 0 Reputation points

2025-07-23T13:38:22.0666667+00:00

When using Azure Frontdoor to manage the certificates, should I be concern about this change?
Bhargavi Naragani 7,940 Reputation points Microsoft External Staff Moderator

2025-07-23T16:22:50.2966667+00:00

Hi Giglioli, Andre,
If you're using Azure Front Door to manage SSL/TLS certificates, you are not impacted by the upcoming changes to Azure App Service Managed Certificates (ASMC) that take effect on July 28, 2025.
Bhargavi Naragani 7,940 Reputation points Microsoft External Staff Moderator

2025-07-23T16:24:09.1733333+00:00

Hi A L,
I've converted my comment to answer.

Please accept my answer if it helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how. Thank you.

Answer accepted by question author

0 additional answers

Your answer

A L 20 Reputation points

2025-07-23T13:05:26.9533333+00:00

@Bhargavi Naragani Thank you, that was the answer I was looking for!
Giglioli, Andre 0 Reputation points

2025-07-23T13:38:22.0666667+00:00

When using Azure Frontdoor to manage the certificates, should I be concern about this change?
Bhargavi Naragani 7,940 Reputation points Microsoft External Staff Moderator

2025-07-23T16:22:50.2966667+00:00

Hi Giglioli, Andre,
If you're using Azure Front Door to manage SSL/TLS certificates, you are not impacted by the upcoming changes to Azure App Service Managed Certificates (ASMC) that take effect on July 28, 2025.
Bhargavi Naragani 7,940 Reputation points Microsoft External Staff Moderator

2025-07-23T16:24:09.1733333+00:00

Hi A L,
I've converted my comment to answer.

Please accept my answer if it helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how. Thank you.

Answer 1

Bhargavi Naragani 7,940 Microsoft External Staff Moderator

Hi A L,

The email you received refers to upcoming industry-mandated changes impacting Azure App Service Managed Certificates (ASMC) starting July 28, 2025, due to DigiCert's move to a new multi-perspective issuance corroboration (MPIC) platform. This change only affects App Service Managed Certificates (ASMC) and not third-party certificates like those from GoDaddy (Microsoft.CertificateRegistration RP).

External endpoints and Azure endpoints refer specifically to Azure Traffic Manager (ATM) configurations, not directly to App Services or Private Endpoints.

In Traffic Manager, there are three endpoint types:

Azure Endpoints: These directly connect to Azure resources (like an Azure Web App).
External Endpoints: These point to services outside Azure, like an on-prem server or a public web service.
Nested Endpoints: These refer to another Traffic Manager profile.

So, if your app uses Traffic Manager and its endpoints are configured as External or Nested, ASMC will not work after July 28.

Ensure your endpoint is of type “Azure Endpoint.”
If you're using External or Nested Endpoints, you’ll need to either restructure your setup to use Azure Endpoints or, use a custom SSL certificate (not an ASMC).

If your app is not using Traffic Manager at all, and it's publicly accessible without restrictions (i.e., no IP filtering, no private endpoints, etc.), you're not impacted by this scenario.

Navigate to your Traffic Manager Profile in the Azure Portal.
Click on Endpoints.
Review each endpoint type listed.
- If it's marked as Azure Endpoint, you're in good state.
- If it says External or Nested, you’ll need to switch or use your own certificate.

Traffic Manager Endpoint Types
Azure App Service Managed Certificates Overview

changes to Azure Service Managed Certificates (ASMS) that will apply from 28 July 2025

Hope this helps, if you have any further concerns or queries, please feel free to reach out to us.

David Alejandro Rodriguez Toro 20 Reputation points

2025-07-23T20:35:57.6533333+00:00

Hi, thanks for the reply. I have a specific case using Azure Service Managed Certificates services. Normally we have azure app services exposed by azure frontdoor, but in the backend configuration we require to configure the same custom domain with a certificate (Azure Service Managed Certificate) because or else private access fails (problems with different certificates etc). In short we use that certificate only to configure that custom domain in that app service (app service uses private endpoint) and has public access disabled (only one service tag allowed from azure frontdoor backend), as additional information, these certificates are downloaded and used not as secrets but as certificates in Azure keyvault and then imported in the app service and bound with the custom domain. I read the documentation (https://techcommunity.microsoft.com/blog/appsonazureblog/important-changes-to-app-service-managed-certificates-is-your-certificate-affect/4435193) and I'm not sure if it probably fits scenario 1.
Bhargavi Naragani 7,940 Reputation points Microsoft External Staff Moderator

2025-07-24T04:09:05.8766667+00:00
Hi David Alejandro Rodriguez Toro,

Yes, most likely, your setup does fall under the first impacted scenario.

Scenario 1: Customer’s site is not publicly accessible "If an app is not accessible from the public internet (e.g., due to private endpoints, IP restrictions, firewalls, etc.), customers won't be able to create or renew a managed certificate for their app starting July 28, 2025."

Even though Azure Front Door can access the app, the public internet cannot. DigiCert’s new MPIC platform requires the validation to succeed from multiple geographically distributed vantage points, something that private access via Front Door alone won’t satisfy. So, while existing ASMCs may remain functional, future renewals or new requests will fail after July 28th if public access remains blocked.

Since your App Service needs to stay private, here’s how you can still securely bind a custom domain: Switch from ASMC to a custom SSL certificate.

You can use Azure Front Door’s managed certificate for the public side (already handled).

For the backend App Service: Use a privately issued certificate, such as one generated via Azure Key Vault Certificate Authority, DigiCert, or another trusted provider.

Store it in Key Vault (as you're doing now), and upload/import it manually into the App Service TLS bindings.

Add an HTTPS Binding with Your Own Certificate (Azure App Service)
Secure Azure App Service Apps with TLS/SSL Certificates
Azure Key Vault Certificates Overview
David Alejandro Rodriguez Toro 20 Reputation points

2025-07-25T13:19:43.95+00:00

Thank you so much for the response. It helps a lot.

Share via

Azure App Service managed certificates change unclear

0 additional answers

Your answer