How to Renew Expired Certificates for Azure Authentication

When working with Microsoft Entra ID (formerly Azure Active Directory), certificates play a crucial role in securing application authentication. If a certificate tied to an App Registration, service principal, or SAML-based SSO integration expires, authentication will fail, leading to downtime for users or automation processes.

Azure uses certificates to:

• Securely authenticate applications and service principals.
• Enable SAML-based Single Sign-On (SSO) with third-party services like Salesforce, AWS, or ServiceNow.
• Sign and encrypt tokens in federation scenarios such as ADFS.

When a certificate expires, apps lose the ability to request or validate tokens, which can break user logins and automation scripts.

See also: Azure Policy Error: How to Enable MFA for Tenant Before October 2025

Step 1: Identify the Expired Certificate

1. Sign in to the Azure portal.
2. Go to Microsoft Entra ID > App registrations (or Enterprise applications).
3. Select the app.
4. Navigate to Certificates & secrets.
5. Review the listed certificates and note any expired ones.

Step 2: Generate a New Certificate

You can either create a self-signed certificate (for testing or internal use) or obtain one from a Certificate Authority (CA).

Option A: Self-signed certificate

Run this PowerShell command on Windows:

New-SelfSignedCertificate -Subject "CN=AppName" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature

Export:

• .cer file → Upload to Azure
• .pfx file → Use in applications or scripts

Option B: CA-issued certificate

Request a new certificate from your internal or third-party CA, then download it as a .cer file.

Step 3: Upload the New Certificate in Azure

1. In the Azure portal, open your app registration.
2. Go to Certificates & secrets.
3. Select Upload certificate.
4. Choose your .cer file and save.

Azure will now trust this new certificate for app authentication.

Step 4: Update Dependent Applications and Services

• For automation scripts or pipelines:
  • Replace the old .pfx certificate with the new one. Update configuration files or scripts that reference the expired certificate.
• For SAML-based SSO apps:
  • Update the new certificate in both Azure AD and the third-party application’s SAML configuration.
• For ADFS scenarios:
  • Ensure both Azure and relying parties recognize the updated token signing/decryption certs.

Step 5: Remove the Expired Certificate

Once the new certificate is verified:

• Go to Certificates & secrets in the app.
• Delete the expired entry to avoid confusion.

Best Practices to Avoid Future Issues

• Always add the new certificate before the old one expires (multiple active certs are supported).
• Store certificates in Azure Key Vault for secure management and automated rotation.
• Use Azure Monitor or scripts to set certificate expiry alerts.
• Plan for 2–3 year validity where policy allows.
• Maintain a renewal SOP (Standard Operating Procedure) for your team.

FAQs: Renew expired certificates Azure authentication

Q1. What happens if I don’t renew an expired certificate in Azure?
Apps and scripts using that certificate will fail authentication, causing downtime.

Q2. Can I have two certificates active at the same time?
Yes. Azure allows multiple valid certificates. This is recommended to ensure smooth rollover.

Q3. Should I use self-signed certificates in production?
No. For production workloads, always use CA-issued certificates for compliance and security.

Q4. How can I monitor certificate expiry automatically?
Use Azure Key Vault certificate monitoring, PowerShell scripts, or Azure Monitor alerts.

Renewing expired certificates in Azure authentication is straightforward but critical for keeping apps and services running smoothly. By uploading a new certificate, updating dependent apps, and removing expired entries, you ensure secure and continuous access.

To prevent last-minute disruptions, always plan renewals in advance and consider Azure Key Vault for automated certificate lifecycle management.