25,132 questions
Hi @Riccardo Gatti - the root CAs listed in our documentation are the only ones that are supported. We do not have any plans at this time to expand the list of root CAs.
SCIM application with Let’s Encrypt
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 3%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERG%3C/text%3E%3C/svg%3E)
Riccardo Gatti
41
Reputation points
Hello, I'm looking to create a new Non-Gallery Application on my Azure AD. I saw the list of the trusted CA in the guide but I have a certificate issued by the new CA of Let's Encrypt that now is ISRG Root X1 and not anymore DST Root CA X3
Is the new CA (ISRG Root X1) of Let's Encrypt certificate supported by Azure?
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 57.00000000000001%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shashi Shailaj 7,631 Reputation points Microsoft Employee Moderator2022-02-22T14:13:29.657+00:00 @Riccardo Gatti ,
Let me check this internally and get back to you on this.
Sign in to comment
Accepted answer
-
Danny Zollner 10,801 Reputation points Microsoft Employee Moderator2022-02-22T18:05:46.707+00:00 -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 87%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
PM 6 Reputation points2022-07-14T21:36:58.283+00:00 That's unfortunate; support for ISRG Root X1 would be useful given it's prevalence and the small number of supported root certs Azure supports for SCIM.
Hopefully Microsoft won't become stuck in the old days again with this type of requirement that doesn't allow us to grow and support what our clients request. If a client is already using Let's Encrypt forcing them to get another cert that now has to be renewed at least yearly causes friction we don't need (from a standpoint of having them use our product which supports Azure). It's interesting that other SCIM implementations don't force you into such limited certificate requirements.
Given that Let's Encrypt is supported elsewhere in Azure, hopefully you will reconsider - I mean it's been around for almost a decade. Too soon? I think they claim to be used in over 8% of all websites. That's more than some of the others you support (just behind Sectigo/Comodo and more than Go Daddy).
Sign in to comment -