Cloud platform · checked November 15, 2026

Is Azure App Service ready for 100-day and 47-day certificates?

Automatic only in some setups

Partly. Some Azure App Service setups renew and install certificates automatically; others need you to act every cycle. See which one you have below.

What renews automatically

• The free App Service managed certificate (issued by DigiCert) renews automatically as long as its prerequisites stay the same.[Microsoft]
• Certificates imported from Key Vault sync to App Service within 24 hours of an update.[Microsoft]

What doesn’t

• Purchased App Service certificates can auto-renew (starting 32 days before expiry), but may need domain re-verification, and each certificate is limited to 198 days.[Microsoft]
• Uploaded certificates: no automatic binding update. You add each renewed certificate yourself.[Microsoft]

When it renews

Purchased App Service certificate: automatic renewal can start 32 days before expiry.[Microsoft]

What to do, and by when

1. March 15, 2027 · In 120 days
   Maximum certificate lifetime drops to 100 days[CA/Browser Forum 1 (CA/Browser Forum — Baseline Requirements for TLS Server Certificates (v2.3.1, 4 Oct 2026)), 2 (CA/Browser Forum — Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods)]
   Move uploaded certificates to managed certificates or Key Vault-backed ones.

Steps

1. In the app's Certificates blade, list each certificate's type.
2. Prefer the free managed certificate where it fits. Otherwise keep certificates in Key Vault so App Service syncs them.
3. For purchased App Service certificates, watch for domain verification requests at renewal.