This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 80%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMF%3C/text%3E%3C/svg%3E)
In documentation there is information, that
Any change to Application Gateway forces a check against Key Vault to see if any new versions of certificates are available
But we have issue, that our certificate will be updated in 1-4h after new version was created in keyvault. But this cannot be triggered by AppGW changes.
Issue is we are reissuing the certificates with new cert provider, so question is if there are special conditions when this certificate update is not triggered for certificate that don't have same thumbprint or have different rootca ?
As this is not documented.
Update:
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
Update: We are using version less URL for secrets.
Hi Michal,
Are you saying you apply change to your Application Gateway, but it doesn't pick new certificate from key vault? Or are you saying you cannot change your Application Gateway? You could have a tag specifically for this purpose, and update it each time to new value.
Hi, I just write this down, maybe it will help someone in future. Root cause that blocked this automatic certificate refresh was certificate tag. I think this is some bug in App GW certificate refresh mechanic ...
After we have removed tags assigned on certificate in key vault, it behaved correctly.
What you are seeing matches a recently clarified behavior. The normal autorotation path is a Key Vault poll every four hours, so a 1–4 hour delay is expected. Although the renewal page says any Application Gateway change triggers a check, Microsoft's newer troubleshooting guidance says that reapplying the same versionless URI—or making an unrelated/empty gateway update—may not force an immediate fetch because keyVaultSecretId did not change.
A different thumbprint, issuer, or root CA is not itself a rotation blocker. The new Key Vault version must still contain a supported, exportable certificate: PFX or PEM with the private key, complete intermediate chain, correct content type, and valid Key Vault access for the gateway's managed identity.
For a deterministic refresh, temporarily change the SSL certificate reference to the latest versioned secret ID, then restore the versionless ID. In CLI terms, run az network application-gateway ssl-cert update first with the latest versioned secret URL, and again with https://<vault>.vault.azure.net/secrets/<certificate>. This changes the value that controls the fetch while preserving future autorotation.
If it still does not rotate, verify the PFX/private key and full chain, identity permissions, Key Vault firewall access, and the gateway provisioning state.
Official guidance:
Hi Christos,
For me it's curious, like I said the certificate works, but I cannot force the auto rotation like we have this in the past. The updated certificate will works, but will be applied in 1-4 hours and we cannot verity that it works with our automation that update certificate, because we don't know how to trigger immediately as doing infrastructure changes or changes to tags don't works, but the certificate in the end will be used.
One issue is, there are no log for this behavior visible to user, what I found is that for example I update tags, then in portal overview page look into JSON configuration, is see on Certificates status -> provisioningState:Updating that they are updating (I don't remember correct naming now).
So issue that It don't work anymore like in the past, and I don't know why.
We could probably do the suggested changes, change the cert reference to the latest versioned and then maybe rerun our AppGW infrastructure pipeline, but for me this looks like a hotfix for issue without doing proper RCA. Not sure why autorotation is working when we wait for 1-4 hour but don't work we we trigger it with changes to appGW.
Edit: I our case it looks like root cause was assigning resource tags on KV certificate have impact on APP GW certificate autorotation.