How to renew managed certificate in APIM during Microsoft update from August 15th 2025 to March 15th 2026 ?

Question

Hi,

I am using managed certificate for custom domain in my dev instance of API management service. and seems like cert is expired and I am not able to renew them during update from August 15th 2025 to March 15th 2026.

Could anyone please be able to help with this ? Thanks

Answer 1

Hi @Gurinder Singh

Thank you for reaching out to Microsoft Q&A.

During the period from August 15, 2025 to March 15, 2026, Microsoft has temporarily suspended the creation of new Azure‑managed certificates for custom domains in Azure API Management due to an industry‑wide transition by the Certificate Authority (DigiCert) away from legacy CNAME‑based domain validation. However, this suspension does not block automatic renewal of existing managed certificates that were created before August 15, 2025. In many cases, customers observe that the certificate appears expired or very close to expiry in the Azure portal. This behavior is expected because Azure does not renew managed certificates on a fixed schedule (for example, 30 days before expiry). The renewal often occurs very close to the actual expiration date. If renewal does not happen, the most common cause is missing inbound network access required by DigiCert for domain validation during the renewal process.

Refer below points to resolve this issue / workaround

Ensure inbound access on port 80 is allowed

For Azure API Management to renew an existing managed certificate, inbound HTTP traffic on port 80 must be allowed so DigiCert can perform domain validation. If port 80 is blocked (for example, only HTTPS 443 is allowed), certificate renewal will fail. Check NSG, firewall, or gateway rules to confirm this access is permitted.

Do not delete or recreate the custom domain configuration

If the custom domain or its managed certificate is deleted and re‑added during the suspension window, Azure will treat it as a new certificate request, which will be blocked until March 15, 2026. Ensure the existing configuration remains unchanged so auto‑renewal stays supported.

Use a customer‑managed certificate as a temporary workaround if required

If renewal fails and service continuity is critical, you can configure the custom domain with a customer‑managed certificate (for example, from Azure Key Vault or a PFX file) during the suspension period. After March 15, 2026, you can switch back to an Azure‑managed certificate if desired.