Home / Azure

AzureRunbookIntermediate

Sev1: site down after the Application Gateway TLS certificate expired

Restore service quickly when browsers show certificate errors because an Application Gateway listener certificate expired or Key Vault renewal didn't reach the gateway. Includes the emergency fix, root causes and the controls that stop it happening again.

Deepak Bhardwaj3 min read

Applies toAzure Application Gateway v2 / WAF v2 with Key Vault-referenced or uploaded certificates

Symptoms

  • Browsers show NET::ERR_CERT_DATE_INVALID; API clients fail with TLS errors.
  • Health probes may still be green (the backend is fine; the front-end listener certificate is the problem).

1. Confirm in 2 minutes

echo | openssl s_client -connect www.contoso.com:443 -servername www.contoso.com 2>/dev/null \
  | openssl x509 -noout -subject -enddate

az network application-gateway ssl-cert list -g rg-web -n agw-prod \
  --query "[].{name:name, kv:keyVaultSecretId}" -o table

2. Emergency fix

Case A: certificate referenced from Key Vault, and Key Vault already has a renewed version

The gateway polls Key Vault every 4 hours. If it couldn't read the vault, it keeps the old certificate. Force it to pick up the current version:

az network application-gateway ssl-cert update -g rg-web --gateway-name agw-prod -n cert-www \
  --key-vault-secret-id "https://kv-web.vault.azure.net/secrets/www-contoso"   # versionless ID

If this fails, check the gateway's managed identity still has get on secrets (access policy) or Key Vault Secrets User (RBAC), and that the Key Vault firewall allows trusted Microsoft services or the gateway's subnet.

Case B: Key Vault certificate also expired (renewal failed)

  1. Issue or obtain a new certificate (your CA, or an emergency certificate from a public CA).
  2. Import it into Key Vault: az keyvault certificate import --vault-name kv-web -n www-contoso -f www.pfx --password ...
  3. Update the listener as in Case A.

Case C: certificate uploaded directly to the gateway (PFX)

az network application-gateway ssl-cert update -g rg-web --gateway-name agw-prod -n cert-www \
  --cert-file www-2027.pfx --cert-password '...'

Updates take a few minutes. Retest with openssl s_client.

3. Check the other hops

  • Front Door / CDN in front? Their certificate is separate (managed or BYO).
  • End-to-end TLS? The backend's own certificate may have expired too: the gateway then reports backends unhealthy with a certificate error in Backend health.

4. Root causes we see most

Cause Prevention
Versioned secret ID used, so renewals are never picked up Always use the versionless secret ID
Key Vault firewall or private endpoint blocks the gateway Allow trusted services; test after network changes
Identity permission removed in an RBAC clean-up Azure Policy / IaC owns the role assignment
Non-integrated CA, manual renewal forgotten Integrate the CA with Key Vault, or use auto-renewing certificates
Uploaded PFX nobody tracked Move to Key Vault references

5. Never again

  • Azure Monitor alert on Key Vault CertificateNearExpiry events (Event Grid) 30 and 7 days before expiry.
  • External synthetic check of the certificate expiry for every public hostname (Application Insights availability test, or any uptime monitor).
  • Inventory: list every listener certificate and its expiry monthly.

Warning

Don't "fix" an expired-certificate outage by switching the listener to HTTP. Clients with HSTS still fail, and you expose traffic. Import a valid certificate; a public CA can issue a DV certificate in minutes.

Related fixes