Azure Front Door certificate auto-renewal with Azure Public DNS Alias record?

Question

Azure Front Door certificate auto-renewal with Azure Public DNS Alias record?

David Tenace 0

If a domain is validated by Azure Front Door via a TXT record, and the DNS apex (contoso.com) is hosted in Azure Public DNS, and a certificate is issued through Azure Front Door, the documentation states that a CNAME DNS record needs to point to AFD for the certificate to automatically renew: https://learn.microsoft.com/en-us/azure/frontdoor/domain#azure-front-door-managed-tls-certificates

We can't create a CNAME record at the apex of the DNS domain (contoso.com), so if we instead created an A record "Alias" pointing to AFD, does that satisfy the auto-renewing certificate requirements?

We want to have the certificates renew without any manual intervention or ad-hoc automation.

0 comments

1 answer

Your answer

Answer 1

TP 163.1K Volunteer Moderator

Hi David,

For apex domain you need to manually revalidate each time using _dnsauth TXT token. Screenshot excerpt from documentation below:

User's image

One option would be to use Bring Your Own Certificate (BYOC) and have DigiCert/GlobalSign issued certificate in Key Vault that rotates automatically. Please reference below three articles for details on setting this up:

Integrating Key Vault with Integrated Certificate Authorities

https://learn.microsoft.com/en-us/azure/key-vault/certificates/how-to-integrate-certificate-authority

Tutorial: Configure certificate autorotation in Key Vault

https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-rotate-certificates

Azure Front Door - Use your own certificate

https://learn.microsoft.com/en-us/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain?tabs=powershell#use-your-own-certificate

Another potential option would be to write your own script that will generate new validation code (when expiration is approaching), create TXT record in Azure DNS, etc., but from your question it seems you prefer not to have ad-hoc automation.

Thanks.

-TP

David Tenace 0 Reputation points

2026-09-03T03:35:04.39+00:00

Thanks TP; we're migrating from AWS to Azure and this is a restriction we didn't expect. With AWS we're able to issue certs via ACM and use an A record Alias in a DNS apex domain pointing to the AWS resource that hosts the cert, and that continues automatically renewing as long as the CNAME validation DNS record exists.

In Azure, I think we expected the same architecture could apply (A record Alias pointing to Azure Front Door which hosts the managed cert), and the TXT validation record (or Alias record to AFD) would allow the cert to automatically renew.

It's interesting that Azure docs say "When you use Azure Front Door-managed TLS certificates with apex domains, the automated certificate rotation might require you to revalidate your domain ownership." The word "might require" doesn't sound like a definitive answer from Microsoft, like there's a scenario where it won't require re-validating the domain manually each cert renewal?
TP 163.1K Reputation points Volunteer Moderator

2026-09-09T05:55:10.7466667+00:00

Hi David, I didn't notice your comment so apologize for delay responding.

In regards to AWS, they own public Certificate Authority (CA) so in my opinion that gives them some advantage here. You can accomplish similar thing [as AWS] using key vault integration with DigiCert/GlobalSign as I mentioned, however, it will cost more.

In regards to the use of the word "might" in the documentation, I'm unsure what scenario they are referring to. In my experience domain re-validation is required for apex, and this is reinforced by others that have asked questions about it here and other places in the past.

Another thing that supports the domain re-validation requirement is Static Web Apps (SWA). If you use Enterprise-grade edge option with SWA it requires TXT validation. Key thing about Enterprise-grade edge feature (if enabled) is it is using Azure Front Door.

Related to all this is the fact that there has been a ton of change related to certificate issuance, validation, etc., in the various Azure services that offer managed certificates due to the Multi-Perspective Issuance Corroboration and other changes at CAs. Even now not all Azure services have finished being updated.

Regardless of how you handle certificates, I recommend monitoring so that you can intervene if certificate renewal fails to complete xx days before expiration, or if service/site doesn't respond with correct certificate given valid SNI.