Entra App Proxy SSL certificate expired

What breaks

An expired Entra App Proxy SSL certificate can interrupt trusted HTTPS access through the custom domain. This guide covers the certificate uploaded for the external URL. See Microsoft's Application Proxy custom-domain guide.

Get warned before the next App Proxy certificate expires

AppAlert emails your admins before expiring credentials break your published apps. Read-only, free during Early Access. Connect read-only

Read-only permissions: Microsoft Graph application permissions Application.Read.All, Directory.Read.All, AgentIdentity.Read.All, AgentIdentityBlueprint.Read.All, AgentIdentityBlueprintPrincipal.Read.All, plus User.Read for sign-in. No write permissions: AppAlert cannot create, rotate, or delete credentials.
Never received: Secret values, certificate private keys, Microsoft account passwords, and mailbox contents. AppAlert stores credential metadata such as type, expiry date, and owner email addresses.
Where data lives: App functions and database in Frankfurt, Germany (Vercel fra1, Neon on AWS eu-central-1). Alert emails are sent through Resend, which stores them in the United States. Data location
Revoke any time: A Microsoft Entra administrator can revoke AppAlert's enterprise application consent. That stops future directory reads; deleting stored data is a separate request. Retention and revocation

How you notice

Microsoft documents one warning: when the certificate expires, Entra tells you to upload another one. Track the expiry date to act before that point. If a certificate is revoked, users might see a browser security warning. See the custom-domain certificate guidance.

Check the Certificate field and the certificate served at the external hostname. Record the affected hostname.

How do I find App Proxy certificates that expire soon?

Use Microsoft's custom-domain inventory script. It uses Microsoft Graph Beta PowerShell with Directory.Read.All. It finds service principals tagged WindowsAzureActiveDirectoryOnPremApp and reads their applications' custom-domain certificate metadata.

This adapted snippet filters on expiryDate. The beta onPremisesPublishing reference defines verifiedCustomDomainCertificatesMetadata as read-only and null for the default domain.

Import-Module Microsoft.Graph.Beta.Applications
Connect-MgGraph -Scopes 'Directory.Read.All'
$WarningDays = 30
$Cutoff = [DateTimeOffset]::UtcNow.AddDays($WarningDays)
Get-MgBetaServicePrincipal -All -Property @('appId', 'tags') -ErrorAction Stop |
    Where-Object { $_.Tags -contains 'WindowsAzureActiveDirectoryOnPremApp' } |
    ForEach-Object {
        $AppId = $_.AppId
        Get-MgBetaApplication -Filter "appId eq '$AppId'" `
            -Property @('id', 'onPremisesPublishing') -ErrorAction Stop |
            ForEach-Object {
                $Publishing = $_.OnPremisesPublishing
                $Certificate = $Publishing.VerifiedCustomDomainCertificatesMetadata
                if ($null -eq $Certificate.ExpiryDate) { return }
                $End = [DateTimeOffset][DateTime]::SpecifyKind($Certificate.ExpiryDate, 'Utc')
                if ($End -le $Cutoff) {
                    [pscustomobject]@{
                        ApplicationId = $_.Id
                        ExternalUrl = $Publishing.ExternalUrl
                        Thumbprint = $Certificate.Thumbprint
                        ValidFrom = $Certificate.IssueDate
                        ValidTo = $End.UtcDateTime.ToString('o')
                    }
                }
            }
    }

Set $WarningDays to your renewal lead time. This example includes expired certificates and skips missing expiry dates. Review missing custom-domain metadata separately. Treat the beta API as a dependency to review before scheduling this check.

Why it happens

Renewing with the issuer does not replace the uploaded certificate. New apps can use a certificate already uploaded for the domain if configured to use it. Each existing app needs the replacement uploaded again. See Microsoft's renewal guidance.

Renewal path

The commands follow Microsoft's documentation and were not run against a real environment.

In the Entra admin center

Follow Microsoft's certificate requirements and upload procedure:

Obtain a replacement PFX with the private key and all required intermediate certificates.
Check that the certificate matches the external URL. A wildcard must match that hostname, or a subject alternative name must cover it.
Open each existing enterprise application that uses the custom domain. Go to Application proxy and select the Certificate field.
Upload the replacement PFX with its password and save each application's settings.
Verify the certificate served at each app's external hostname, then test HTTPS access and sign-in.

Microsoft's certificate requirements and upload instructions distinguish new apps from existing apps. Uploading once does not update every existing app on the domain.

After replacement, Microsoft automatically deletes old certificates that no other apps use.

Replace the certificate on every app with PowerShell

Use Microsoft's certificate replacement script to update all App Proxy apps that share the current thumbprint. It requires Microsoft Graph Beta PowerShell module 2.10 or newer, Directory.ReadWrite.All, and at least the Application Administrator or Application Developer role.

Save the linked sample as get-custom-domain-replace-cert.ps1. The script updates every matching app without a confirmation step, so run the inventory above first to see which apps use the current thumbprint. Test the replacement on one app through the portal before a bulk update. Run the script with the current thumbprint and replacement PFX path:

.\get-custom-domain-replace-cert.ps1 `
    -CurrentThumbprint '<current-certificate-thumbprint>' `
    -PFXFilePath '<replacement-pfx-path>'

The script calls Update-MgBetaApplication. It sets onPremisesPublishing.verifiedCustomDomainKeyCredential to type X509CertAndPassword with the Base64-encoded PFX. It also sets verifiedCustomDomainPasswordCredential. The beta publishing reference describes these properties. Enter the PFX password at the script's secure prompt. Keep the PFX and password out of logs.

Verify the served certificate and test access on every updated app.

Who should own it

Assign the change to an Application Proxy administrator with the certificate administrator available. Include affected application owners in verification.

Lead time and business-day math

Suggested planning buffer: 30 calendar days. Allow working days for certificate issuance and an external access test before any change freeze.

A separate SAML signing certificate may also affect sign-in. A client authentication certificate can expire separately. Replacing the App Proxy SSL certificate does not renew either one.

Monitored by AppAlert

Monitored

AppAlert monitors Application Proxy SSL certificate expiry and sends email alerts to configured admin recipients before a certificate expires, with optional routing to application owners.

Test the certificate served at the external hostname after renewal.

Use the Operations queue to review the expiry and application context. Configure who receives alerts in Alert settings and recipients; for a missing alert, follow Missing notifications.