Automated SSL certificate renewal for Microsoft Entra Application Proxy

Application Proxy won't renew a custom domain certificate on its own. CertKit will.

An Application Proxy app published on a custom domain serves the PFX someone uploaded on its Application proxy page. When that certificate renews, Entra keeps serving the old one until someone uploads the new PFX, app by app, before the old one expires. Every 47 days.

CertKit issues and renews the certificate centrally, then the CertKit Agent uploads it through Microsoft Graph to every App Proxy app it covers. Nothing to install on your connector servers.

Start free trial Watch demo

Built for Entra Application Proxy Beta

Pre-built templates for client secret and managed identity sign-in ship in your CertKit account, currently in beta.

On every renewal, the agent signs in to Microsoft Graph, finds the App Proxy apps whose external URL the certificate covers, and uploads the PFX to each one. It waits for Entra to report the new thumbprint before it marks an app done. There's no restart, and Entra starts serving the new certificate a minute or two later.

Sign in with an app registration and client secret from any Windows host, or with the managed identity of an Azure VM or Azure Arc-enabled server so there's no secret to rotate. Either way, the identity only needs Application.ReadWrite.OwnedBy and ownership of the apps it updates.

How to upload a custom domain certificate to Entra Application Proxy

The manual process, if you want to do it yourself:

Get a PFX that covers the external URL. Entra needs the certificate, its private key, and the intermediates in one PFX file. A wildcard certificate for *.example.com covers app.example.com but not app.hr.example.com. Microsoft says to keep the PFX password to letters and digits.
Use a verified custom domain. The domain must show as Verified under Entra ID → Domain names. If it's missing from the External URL list on the app, it isn't verified. The external URL also needs a CNAME record that points to the app's msappproxy.net address.
Upload the certificate. In the Microsoft Entra admin center, open Entra ID → Enterprise applications, pick the app, and select Application proxy. Select the Certificate field, browse to the PFX on the SSL certificate page, enter its password, choose Upload Certificate, then Save. A bad file or password gets an error about an invalid certificate or possible wrong password.
Upload it again for every existing app. Microsoft's docs say a new upload applies to apps created after it. Apps that already used the domain need the renewed certificate uploaded on their own Application proxy page.
Check it and track expiry. Browse to the external URL from outside your network and check the certificate. Entra deletes old certificates that no app uses, but it only warns you about a certificate once it has expired, so track each app's expiry date yourself.

Every one of these steps is manual, and Entra won't repeat any of them when the certificate renews. With lifetimes shrinking to 47 days, that's twelve times a year, for every app on every custom domain. Miss one and remote users opening that app get a certificate error instead of the app.

At 47 days, automation is the only sustainable way to run Application Proxy certificates. Here's how CertKit does it.

Using CertKit to manage our public-facing SSL certificates has been an excellent decision. The platform is user-friendly, certificates are easy to deploy, and the automation agent streamlines the entire certificate lifecycle, eliminating concerns around shortening certificate validity periods.

Chris Austin, IT Engineer, Buckman

How it works

 Your network            CertKit                 ACME CA
┌───────────────────┐     ┌──────────────────┐    ┌─────────────┐
│  ┌─────────────┐  │     │                  │    │             │
│  │CertKit Agent├──┼────►│  Issue & Renew   │◄──►│             │
│  └──────┬──────┘  │     │   Certificates   │    │             │
│         │ Graph   │     │                ┌───┐  └─────────────┘
│         │ API     │     └───────────┬────│DNS│
└─────────┼─────────┘                 │    └───┘
          ▼                           │
┌───────────────────┐                 │
│ Entra App Proxy   │                 │
│ [x] Uploaded      │ ◄───────────────┘
│ [x] Confirmed     │       Verify
└───────────────────┘

CertKit issues and renews certificates centrally using delegated DNS validation. You create a one-time CNAME record, and CertKit handles every ACME challenge after that.

The CertKit Agent runs on a Windows host you choose. It pulls each renewal from CertKit over outbound HTTPS, then signs in to Microsoft Graph and uploads the PFX to each App Proxy app. Entra's edge serves the certificate, not your connectors, so the connector servers never run ACME, never hold DNS credentials, and need no changes.

What CertKit handles

Issue and renew centrally. The one-time CNAME covers every renewal challenge.
Find every app the certificate covers. By default the agent lists the tenant's App Proxy apps and picks the ones whose external URL the certificate covers. Apps on the default msappproxy.net domain and Private Access apps are skipped. You can also list apps by name or Application ID.
Upload the PFX to each app through Microsoft Graph. One upload per app, which is what Entra needs for apps that already exist. Apps that already have the certificate are left alone.
Confirm with Entra before reporting success. After each upload, the agent checks the app until Entra reports the new thumbprint. An app that doesn't show it within a minute is reported as a failure.
Sign in without an admin at the keyboard. A client secret or an Azure managed identity, with a Graph permission that only reaches the apps the identity owns.
Verify what users see. Add the external URL to CertKit host monitoring, and CertKit checks from the cloud that the app serves the latest certificate.
Alert on failure. Every app that fails is named in the deployment result with Entra's reason, such as a host name the certificate doesn't cover.
Audit every change. Every issuance, renewal, and deployment is logged. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit.
Give CertKit an identity in Entra. An app registration with a client secret, or the managed identity of an Azure VM or Arc-enabled server. Grant it the Microsoft Graph application permission Application.ReadWrite.OwnedBy with admin consent, and add it as an owner of each App Proxy app.
Install the CertKit Agent. One command on a Windows host, plus the Microsoft Graph PowerShell authentication module installed for all users.
Add the Entra Application Proxy deployment script. Choose the client secret or managed identity template. Leave the app list at * to update every app the certificate covers.

See the full architecture →

Entra Application Proxy deployment requirements and troubleshooting →

Questions about the beta? Talk to the engineering team →

Why not Microsoft's replace-certificate script?

Microsoft publishes a sample PowerShell script that finds every App Proxy app using a given certificate thumbprint and uploads a new PFX to each. It signs in as an administrator with Directory.ReadWrite.All and asks for the PFX password at the prompt. Someone still has to get the renewed PFX, sit at the keyboard, and run it before the old certificate expires.

CertKit runs the same upload unattended on every renewal. The agent signs in as an identity that can change only the apps it owns, and reads the PFX password CertKit writes next to the file. No one types a password, and no admin account holds tenant-wide write access for a certificate job.

Application Proxy is just one part of your Microsoft stack

Most Microsoft environments have more than one place where certificates live: Azure Key Vault feeding your Azure services, AD FS for federated sign-in, and Remote Desktop Services for remote users who need a full desktop. CertKit automates all of it from one account.

See all integrations

Start automating Application Proxy certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing