App Service Certificate Rekey Issue – PFX Thumbprint Mismatch with Azure Key Vault

Hello @Sourav Pratap

Thank for reaching out Microsoft Q&A.

We're looking into your issue, will get back to you shortly.

Hello @Sourav Pratap

This behavior is expected and is not a known issue with Azure App Service Certificates or Azure Key Vault synchronization.

When an App Service Certificate is rekeyed, Azure issues a new certificate with a new private key and stores it as a new version of the certificate secret in Azure Key Vault. Each version of a Key Vault certificate/secret has its own thumbprint. It explicitly documents that exporting a certificate (PFX) from Key Vault produces a static copy of a specific secret version, and exported PFX files do not automatically update when a certificate is renewed or rekeyed.

• The thumbprint shown in the App Service Certificate resource reflects the latest certificate version after rekey.
• The thumbprint of a downloaded PFX reflects only the Key Vault secret version that was exported.
• If an older secret version is downloaded, the PFX thumbprint will not match the latest App Service Certificate thumbprint.

The downstream services such as Azure Application Gateway, certificates should be referenced directly from Azure Key Vault rather than by uploading exported PFX files. Application Gateway supports referencing a versionless Key Vault secret identifier, which allows it to automatically retrieve and rotate to the latest certificate version after a rekey or renewal, avoiding thumbprint mismatches entirely.

Recommended fix:
Option 1 :

Point Azure Application Gateway to a versionless Key Vault secret instead of uploading a PFX file.

Steps:

Update the HTTPS listener to use the Key Vault secret ID (versionless).

Ensure Application Gateway has GET access via Managed Identity.

Save any config change to force a Key Vault check.

Why it works:

• Application Gateway automatically polls Key Vault and rotates to the latest certificate.
• Versionless secrets remove dependence on static PFX files.
• Rekey or renewal no longer causes outages.

Option 2: If Key Vault integration cannot be enabled immediately:

• Go to Azure Key Vault > Certificates > Latest version of the App Service Certificate.
• Download the PFX from the latest secret version (older versions will not match).
• Upload the newly downloaded PFX to Application Gateway.
• Replace the existing listener certificate.

Reference:
https://learn.microsoft.com/en-us/azure/application-gateway/key-vault-certs
https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-azure-app-service-certificates
https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal
https://learn.microsoft.com/en-us/troubleshoot/azure/application-gateway/application-gateway-key-vault-common-errors

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.