Add and manage App Service certificates - Azure App Service (2024)

This article shows how to create an App Service certificate and perform management tasks like renewing, synchronizing, and deleting certificates. Once you have an App Service certificate, you can then import it into an App Service app. An App Service certificate is a private certificate that's managed by Azure. It combines the simplicity of automated certificate management and the flexibility of renewal and export options.

If you purchase an App Service certificate from Azure, Azure manages the following tasks:

• Handles the purchase process from GoDaddy.
• Performs domain verification of the certificate.
• Maintains the certificate in Azure Key Vault.
• Manages certificate renewal.
• Synchronizes the certificate automatically with the imported copies in App Service apps.

Prerequisites

• Create an App Service app. The app's App Service plan must be in the Basic, Standard, Premium, or Isolated tier. See Scale up an app to update the tier.

Buy and configure an App Service certificate

Buy the certificate

1. Go to the Create App Service certificate page to start the purchase.

   Note

   App Service Certificates purchased from Azure are issued by GoDaddy. For some domains, you must explicitly allow GoDaddy as a certificate issuer by creating a CAA domain record with the value 0 issue godaddy.com.

   

2. To configure the certificate, use the following table. When you're done, select Review + Create, and then select Create.

   Setting	Description
   Subscription	The Azure subscription to associate with the certificate.
   Resource Group	The resource group that will contain the certificate. You can either create a new resource group or select the same resource group as your App Service app.
   SKU	Determines the type of certificate to create, either a standard certificate or a wildcard certificate.
   Naked domain hostname	Specify the root domain. The issued certificate provides security for both the root domain and the www subdomain. In the issued certificate, the Common Name field specifies the root domain, and the Subject Alternative Name field specifies the www domain. To provide security for only a subdomain, specify the fully qualified domain name for the subdomain, for example, mysubdomain.contoso.com.
   Certificate name	The friendly name for your App Service certificate.
   Enable auto renewal	Select whether to automatically renew the certificate before expiration. Each renewal extends the certificate expiration by one year. The cost is charged to your subscription.

3. When deployment is complete, select Go to resource.

Store the certificate in Azure Key Vault

Key Vault is an Azure service that helps safeguard cryptographic keys and secrets used by cloud applications and services. For App Service certificates, we recommend that you use Key Vault. After you finish the certificate purchase process, you must complete a few more steps before you start using the certificate.

1. On the App Service Certificates page, select the certificate. On the certificate menu, select Certificate Configuration > Step 1: Store.

   

   See Also

   Citrix Customer ServiceSecure remote VM access in Microsoft Entra Domain Services - Microsoft Entra IDVirtual Machines - Security | Microsoft AzureSecurely connect to your Azure Virtual Machines – the options

2. On the Key Vault Status page, select Select from Key Vault.

3. If you create a new vault, set up the vault based on the following table, and make sure to use the same subscription and resource group as your App Service app.

   Setting	Description
   Resource group	Recommended: The same resource group as your App Service certificate.
   Key vault name	A unique name that uses only alphanumeric characters and dashes.
   Region	The same location as your App Service app.
   Pricing tier	For information, see Azure Key Vault pricing details.
   Days to retain deleted vaults	The number of days, after deletion, that objects remain recoverable. (See Azure Key Vault soft-delete overview.) Set a value between 7 and 90.
   Purge protection	Enabling this option forces all deleted objects to remain in soft-deleted state for the entire duration of the retention period.

4. Select Next and then select Vault access policy. Currently, App Service certificates support only Key Vault access policies, not the RBAC model.

5. Select Review + create, and then select Create.

6. After the key vault is created, don't select Go to resource. Wait for the Select key vault from Azure Key Vault page to reload.

7. Select Select.

8. After you select the vault, close the Key Vault Repository page. The Step 1: Store option should show a green check mark to indicate success. Keep the page open for the next step.

Confirm domain ownership

1. From the same Certificate Configuration page as in the previous section, select Step 2: Verify.

   

2. Select App Service Verification. Because you mapped the domain to your web app earlier in this section, the domain is already verified. To finish this step, just select Verify, and then select Refresh until the message Certificate is Domain Verified appears.

The following domain verification methods are supported:

Once your certificate is domain-verified, you're ready to import it into an App Service app.

Renew an App Service certificate

By default, App Service certificates have a one-year validity period. Before the expiration date, you can automatically or manually renew App Service certificates in one-year increments. The renewal process effectively gives you a new App Service certificate with the expiration date extended to one year from the existing certificate's expiration date.

1. To change the automatic renewal setting for your App Service certificate at any time, on the App Service Certificates page, select the certificate.

2. On the left menu, select Auto Renew Settings.

3. Select On or Off, and then select Save.

   If you turn on automatic renewal, certificates can start automatically renewing 32 days before expiration.

4. To manually renew the certificate instead, select Manual Renew. You can request to manually renew your certificate 60 days before expiration, but certificates can't be issued for longer than 397 days.

5. After the renew operation completes, select Sync.

   The sync operation automatically updates the hostname bindings for the certificate in App Service without causing any downtime to your apps.

   Note

   If you don't select Sync, App Service automatically syncs your certificate within 24 hours.

Rekey an App Service certificate

If you think your certificate's private key is compromised, you can rekey your certificate. This action rotates the certificate with a new certificate issued from the certificate authority.

1. On the App Service Certificates page, select the certificate. From the left menu, select Rekey and Sync.

2. To start the process, select Rekey. This process can take 1-10 minutes to complete.

3. You might also be required to reconfirm domain ownership.

4. After the rekey operation completes, select Sync.

   The sync operation automatically updates the hostname bindings for the certificate in App Service without causing any downtime to your apps.

   Note

   If you don't select Sync, App Service automatically syncs your certificate within 24 hours.

Export an App Service certificate

Because an App Service certificate is a Key Vault secret, you can export a copy as a PFX file, which you can use for other Azure services or outside of Azure.

The downloaded PFX file is a raw PKCS12 file that contains both the public and private certificates and has an import password that's an empty string. You can locally install the file by leaving the password field empty. You can't upload the file as-is into App Service because the file isn't password protected.

Delete an App Service certificate

If you delete an App Service certificate, the delete operation is irreversible and final. The result is a revoked certificate, and any binding in App Service that uses the certificate becomes invalid.

1. On the App Service Certificates page, select the certificate.

2. From the left menu, select Overview > Delete.

3. When the confirmation box opens, enter the certificate name, and then select OK.

Frequently asked questions

My App Service certificate doesn't have any value in Key Vault

Your App Service certificate is probably not yet domain-verified. Until domain ownership is confirmed, your App Service certificate isn't ready for use. As a Key Vault secret, it maintains an Initialize tag, and its value and content-type remain empty. When domain ownership is confirmed, the key vault secret shows a value and a content-type, and the tag changes to Ready.

I can't export my App Service certificate with PowerShell

Your App Service certificate is probably not yet domain-verified. Until domain ownership is confirmed, your App Service certificate isn't ready for use.

What changes does the App Service certificate creation process make to my existing key vault?

The creation process makes the following changes:

• Adds two access policies in the vault:
  • Microsoft.Azure.WebSites (or Microsoft Azure App Service)
  • Microsoft certificate reseller CSM Resource Provider (or Microsoft.Azure.CertificateRegistration)
• Creates a delete lock called AppServiceCertificateLock on the vault to prevent accidental deletion of the key vault.

Related content

• Secure a custom DNS name with a TLS/SSL binding in Azure App Service
• Enforce HTTPS
• Enforce TLS 1.1/1.2
• Use a TLS/SSL certificate in your code in Azure App Service
• Frequently asked questions about creating or deleting resources in Azure App Service