How to have my Linux App Service get update root certs?

fyi.. I'm not running inside an App Service Environment.

Hi @David S,

Thank you for submitting your question on Microsoft Q&A.

Typically, this issue occurs because Linux App Service instances use the trust store that comes with the underlying operating system image. Microsoft updates these OS images on a scheduled basis, not instantly when a Certificate Authority releases a new root certificate. As a result, if a CA (such as GoGetSSL) publishes a new root certificate, it may not yet be included in the App Service’s OS image, causing the certificate to be treated as untrusted until the next platform update is rolled out.

Why the new GoGetSSL cert isn’t trusted
Your new certificate likely chains to a newer GoGetSSL root or intermediate CA that wasn’t present in the Linux App Service image at the time. Linux App Service uses a base image (often based on Ubuntu or Debian) with a pre-installed CA bundle. If the CA bundle is outdated, SSL validation fails.

Microsoft updates the App Service platform images as part of their regular OS patching cycles, which typically occur every few weeks. During these updates, the platform pulls in the latest security patches and refreshed CA certificates from the underlying Linux distribution (via packages like ca-certificates).

Since App Service runs on a shared, managed platform, there is no manual way for customers to force an immediate OS or trust-store update. The only options that can indirectly help are:

• Redeploying to a newer runtime stack, because newer stacks often run on a more recent platform image with updated CA certificates.
• Restarting your App Service once Microsoft has rolled out the updated image, because updates become effective during scheduled maintenance windows.

Options to fix this now

1. Temporary workaround (already applied): Use a certificate from a widely trusted CA such as Let’s Encrypt, since their root certificates are already included in the App Service Linux trust store.
2. Custom container approach: If you must use the new GoGetSSL certificate immediately, you can switch your Linux App Service to a custom Docker container. In a custom container, you have full control over the OS trust store, so you can manually install the missing GoGetSSL root certificate and ensure your application trusts it right away.

In your Dockerfile, run

apt-get update && apt-get install -y ca-certificates

This ensures the latest CA bundle.

3. Wait for the platform update (default path)

Microsoft will eventually refresh the CA bundle in the underlying App Service Linux image as part of their normal patch cycle. Once that update rolls out, the new GoGetSSL root certificate will automatically be included and your app will start trusting your original certificate again. However, the timing depends entirely on Microsoft’s scheduled maintenance and OS image update cycle, so it may not be immediate.

You can check the current CA bundle by running

openssl version -a 
ls /etc/ssl/certs/

via SSH or Kudu console

Best practices going forward

• Use a custom container if you rely on a specific Certificate Authority (CA). This gives you complete control over the OS trust store, allowing you to install or update CA roots whenever you need without waiting for Microsoft’s platform updates.
• Prefer well-established, widely trusted CAs whenever possible. Providers like DigiCert and Let’s Encrypt are included in most Linux CA bundles by default and are updated frequently, reducing the risk of trust issues in managed platforms like Azure App Service.

Reference

https://learn.microsoft.com/en-us/azure/azure-linux/how-to-install-certs?source=recommendations

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code?source=recommendations&tabs=windows
Kindly let us know if the above comment helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Ramamurthy,

Is there a way for me to know when the App Service image has been refreshed? You listed commands to check the current CA bundle, but can you tell me what to look for in the results that could help me to know when it has been updated?

Thanks.

Hi @David S,

Thank you for your question. Here is the detailed explanation: You can verify whether the App Service image has been refreshed by inspecting the CA certificate bundle on your Linux App Service instance. When Microsoft updates the underlying OS image, the ca-certificates package is also updated. This package contains the trusted root certificates, so if you see the latest certificates included, it confirms that your App Service instance is running on the updated base image.

Here’s what you can do is:

1. Check the current CA bundle:

SSH into your Linux App Service or use the Kudu console.

Run:

openssl version -a
ls /etc/ssl/certs/

This shows the OpenSSL version and the list of installed root certificates.

2. What to look for:

First, identify the GoGetSSL root or intermediate certificate based on their documentation or by reviewing your certificate chain.

Next, connect to your Linux App Service instance and check the /etc/ssl/certs/ directory. Search for the corresponding certificate name in that folder.

If the GoGetSSL certificate is present in /etc/ssl/certs/, it means the App Service image has been refreshed and now includes the updated CA bundle. As a result, your original certificate should be recognized and trusted.

Alternatively, run

openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt your-cert.pem

If verification succeeds, the trust store includes the required root.

Timing of updates:

Microsoft does not publish exact dates for image refreshes, but updates typically occur during regular patch cycles (every few weeks).

There is no manual way to force an update on the managed platform.

The issue resolve once the App Service platform refreshes its Linux image with the updated CA bundle, your original GoGetSSL certificate will start working automatically. Until then, the workaround (Let’s Encrypt or custom container) remains the only immediate solution.

Kindly let us know if the above comment helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Hi @David S,

Could you please review my comments, follow the steps, and let me know whether your issue has been resolved?