App Service Managed Certificate renewal with Cloudflare-proxied CNAME

Question

App Service Managed Certificate renewal with Cloudflare-proxied CNAME

Nas 25

Hello Microsoft Support,

We are using Azure App Service behind Cloudflare.

We have found that when a custom domain CNAME is proxied in Cloudflare, Azure App Service Managed Certificate validation fails on the CNAME check, although the TXT validation passes. If we temporarily change the record to DNS only (unproxied), validation succeeds and the certificate is issued.

We would like to confirm:

Is this expected behavior?
Will the same issue affect automatic renewal of the App Service Managed Certificate?
Are App Service Managed Certificates officially supported for domains that remain permanently proxied through Cloudflare?
If not, what is the recommended certificate approach for App Service origins behind Cloudflare?

This is important for us because we need a reliable long-term certificate renewal model for production domains fronted by Cloudflare.

Kind regards,

Nas 25 Reputation points

2026-04-17T08:11:10.4366667+00:00
Thank you.

Could you please clarify this against the current Microsoft documentation for App Service Managed Certificates?

The document “App Service Managed Certificate Changes – July 2025 and November 2025 Updates” states that:

from July 28, 2025, ASMC uses HTTP token validation for both apex and subdomains

from November 2025, App Service handles DigiCert validation requests at the front-end layer

if the initial certificate request succeeds, renewals should also work, provided requirements are met and the scenario is not unsupported

Based on that, could you confirm specifically whether a Cloudflare-proxied CNAME is an officially unsupported scenario for ASMC issuance or renewal?

If so, please point me to the exact Microsoft documentation stating that Cloudflare proxying prevents ASMC renewal.

If not, then should we understand that the proxied CNAME issue affects only the custom-domain verification stage in App Service, rather than the ASMC renewal flow itself?

Thank you.
Golla Venkata Pavani 4,830 Reputation points Microsoft External Staff Moderator

2026-04-20T19:38:19.5866667+00:00
Hello @**Nasir Ahmed

**Thank you for your detailed follow-up and for referencing the official documentation directly.

1. Cloudflare-proxied CNAME is not an officially unsupported scenario for App Service Managed Certificate (ASMC) issuance or renewal.

The documentation lists only these unsupported scenarios as of November 2025:

Your site is an Azure Traffic Manager “nested” or “external” endpoint (only Azure Endpoints are supported).

Certificates issued to *.trafficmanager.net domains.

There is no mention of Cloudflare, proxying (orange cloud), CDNs, or any DNS proxy behavior as unsupported or blocked.

Will the same issue affect automatic renewal? / Is Cloudflare proxying officially unsupported?

From July 28, 2025: ASMC uses HTTP token validation for both apex and subdomains. DigiCert validates by requesting https://<your-custom-hostname>/.well-known/pki-validation/fileauth.txt.

From November 2025: App Service front-ends now handle and respond to DigiCert’s validation requests at the platform layer. This works even if the app itself blocks public access (as long as a public DNS record exists).
Golla Venkata Pavani 4,830 Reputation points Microsoft External Staff Moderator

2026-04-21T20:58:29.5233333+00:00

Hello @Nasir Ahmed

I'm just reaching out to see if your issue has been resolved or if you've had a chance to review my previous comment?
Varun Burra 5 Reputation points Microsoft External Staff Moderator

2026-04-28T13:37:45.02+00:00

Hello @Nasir Ahmed,

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Nas 25 Reputation points

2026-04-29T08:43:55.58+00:00

Thanks Varuna

Answer accepted by question author

0 additional answers

Your answer

Nas 25 Reputation points

2026-04-17T08:11:10.4366667+00:00

Thank you.

Could you please clarify this against the current Microsoft documentation for App Service Managed Certificates?

The document “App Service Managed Certificate Changes – July 2025 and November 2025 Updates” states that:

from July 28, 2025, ASMC uses HTTP token validation for both apex and subdomains

from November 2025, App Service handles DigiCert validation requests at the front-end layer

if the initial certificate request succeeds, renewals should also work, provided requirements are met and the scenario is not unsupported

Based on that, could you confirm specifically whether a Cloudflare-proxied CNAME is an officially unsupported scenario for ASMC issuance or renewal?

If so, please point me to the exact Microsoft documentation stating that Cloudflare proxying prevents ASMC renewal.

If not, then should we understand that the proxied CNAME issue affects only the custom-domain verification stage in App Service, rather than the ASMC renewal flow itself?

Thank you.
Golla Venkata Pavani 4,830 Reputation points Microsoft External Staff Moderator

2026-04-20T19:38:19.5866667+00:00

Hello @**Nasir Ahmed

**Thank you for your detailed follow-up and for referencing the official documentation directly.

1. Cloudflare-proxied CNAME is not an officially unsupported scenario for App Service Managed Certificate (ASMC) issuance or renewal.

The documentation lists only these unsupported scenarios as of November 2025:

Your site is an Azure Traffic Manager “nested” or “external” endpoint (only Azure Endpoints are supported).

Certificates issued to *.trafficmanager.net domains.

There is no mention of Cloudflare, proxying (orange cloud), CDNs, or any DNS proxy behavior as unsupported or blocked.

Will the same issue affect automatic renewal? / Is Cloudflare proxying officially unsupported?

From July 28, 2025: ASMC uses HTTP token validation for both apex and subdomains. DigiCert validates by requesting https://<your-custom-hostname>/.well-known/pki-validation/fileauth.txt.

From November 2025: App Service front-ends now handle and respond to DigiCert’s validation requests at the platform layer. This works even if the app itself blocks public access (as long as a public DNS record exists).
Golla Venkata Pavani 4,830 Reputation points Microsoft External Staff Moderator

2026-04-21T20:58:29.5233333+00:00

Hello @Nasir Ahmed

I'm just reaching out to see if your issue has been resolved or if you've had a chance to review my previous comment?
Varun Burra 5 Reputation points Microsoft External Staff Moderator

2026-04-28T13:37:45.02+00:00

Hello @Nasir Ahmed,

Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Nas 25 Reputation points

2026-04-29T08:43:55.58+00:00

Thanks Varuna

Answer 1

Hello @Nasir Ahmed

Thank you for your detailed follow-up and for referencing the official documentation.

Based on the latest updates to App Service Managed Certificates (ASMC), the behavior you’re observing can be clarified as follows:

Cloudflare-proxied CNAME is not an officially unsupported scenario for ASMC. Current Microsoft documentation does not list Cloudflare, DNS proxying, or CDN-fronted domains as unsupported for either certificate issuance or renewal. User's image

What changed (July–November 2025 updates):

From July 28, 2025, ASMC uses HTTP token validation instead of relying solely on DNS validation
From November 2025, validation requests from DigiCert are handled directly by the App Service front-end layer, not your app
Validation is performed via: https://<your-domain>/.well-known/pki-validation/...

Implications for Cloudflare-proxied domains:

Since validation is now HTTP-based and handled at the platform level, Cloudflare proxying (orange cloud) should not block certificate issuance or renewal, as long as:
- The domain publicly resolves
  - HTTPS traffic can reach Azure App Service endpoints
  - The earlier issue you observed (CNAME validation failing when proxied) is tied to the custom domain verification step in App Service, not the ASMC issuance/renewal process itself

Regarding renewals:

If the certificate was successfully issued under the new validation model and all requirements remain satisfied, automatic renewal should continue to work, even with Cloudflare proxying enabled.

Reference:
https://techcommunity.microsoft.com/blog/appsonazureblog/important-changes-to-app-service-managed-certificates-is-your-certificate-affect/4435193
If the answer is helpful, Please do click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you

Share via

App Service Managed Certificate renewal with Cloudflare-proxied CNAME

0 additional answers

Your answer