How to Renew Expired Azure Certificates for Authentication (Entra ID Guide)

If a certificate tied to a Microsoft Entra ID App Registration, service principal, or SAML-based SSO integration expires, authentication fails immediately. Apps stop working, automation scripts break, and users cannot sign in. This guide shows you exactly how to renew expired Azure certificates, update every dependent service, and prevent it from happening again.

Why Certificates Are Critical for Azure App Authentication

Azure relies on certificates to:

• Securely authenticate applications and service principals
• Enable SAML-based Single Sign-On (SSO) with services like Salesforce, AWS, or ServiceNow
• Sign and encrypt tokens in federation scenarios such as ADFS

When a certificate expires, Azure can no longer issue or validate tokens. This breaks user sign-ins, background jobs, CI/CD pipelines, and API access.

Common Errors Caused by Expired Azure Certificates

Expired certificates often surface as authentication errors, including:

• AADSTS700027 – Client assertion contains an expired certificate
• AADSTS50058 – Silent sign-in request failed (session expired or no active session)
• SAML authentication failed due to invalid signing certificate
• Token signature validation failed in federation or API scenarios

If these appear suddenly, always check certificate expiry first.

Step 1: Identify the Expired Certificate

1. Sign in to the Azure portal
2. Go to Microsoft Entra ID
3. Open App registrations or Enterprise applications
4. Select the affected application
5. Navigate to Certificates & secrets
6. Review the certificate list and check expiration dates

Replace any expired or near-expiry certificate immediately.

Step 2: Generate a New Certificate

You can use either a self-signed certificate (testing or internal use) or a CA-issued certificate (recommended for production).

Option A: Create a Self-Signed Certificate (Windows)

The New-SelfSignedCertificate cmdlet generates a certificate directly in your Windows certificate store:

New-SelfSignedCertificate `
  -Subject "CN=AppName" `
  -CertStoreLocation "Cert:\CurrentUser\My" `
  -KeyExportPolicy Exportable `
  -KeySpec Signature

Export the certificate as:

• .cer to upload to Azure
• .pfx for use by apps, scripts, or pipelines

Option B: Use a CA-Issued Certificate

Request a certificate from your internal or third-party Certificate Authority and export it as a .cer file. For production workloads, CA-issued certificates are strongly recommended.

Step 3: Upload the New Certificate to Azure

Full guidance is available in the Microsoft Entra app registration certificate documentation.

1. Open the App Registration in Azure
2. Go to Certificates & secrets
3. Click Upload certificate
4. Select the new .cer file
5. Click Save

Azure immediately trusts the new certificate once you save.

Step 4: Verify the New Certificate Works

Before touching any dependent services, confirm the new certificate authenticates correctly.

Using PowerShell:

$cert = Get-Item "Cert:\CurrentUser\My\<thumbprint>"
$tenantId = "<your-tenant-id>"
$appId = "<your-app-id>"

Connect-AzAccount -ServicePrincipal `
  -TenantId $tenantId `
  -ApplicationId $appId `
  -CertificateThumbprint $cert.Thumbprint

If this returns a valid session, the certificate is working. Only proceed to Step 5 after this confirms success.

Using Azure CLI:

az login --service-principal \
  --username <app-id> \
  --tenant <tenant-id> \
  --password <path-to-cert.pfx>

A successful login output confirms the new certificate is trusted by Azure.

Step 5: Update Dependent Applications and Services

Uploading the certificate in Azure alone is not enough. Every service that uses the old certificate must be updated.

Automation Scripts and CI/CD Pipelines

• Replace the old .pfx file with the new one
• Update configuration files or secret references
• Restart pipelines or services if required

SAML-Based SSO Integrations

SAML applications in Azure use a dedicated signing certificate that needs updating in two places.

In Azure:

1. Go to Microsoft Entra ID > Enterprise applications
2. Select the affected application
3. Go to Single sign-on > SAML Certificates section
4. Click Edit and add the new certificate
5. Set it as Active
6. Download the new Federation Metadata XML or Certificate (Base64)

In the third-party service (Salesforce, AWS, ServiceNow, etc.):

1. Open the SSO or SAML settings in the third-party portal
2. Replace the old signing certificate with the downloaded .cer or Base64 certificate
3. Save and test a sign-in before removing the old certificate from Azure

ADFS and Federation Scenarios

• Ensure relying parties trust the updated token signing or decryption certificate
• Run Update-MSOLFederatedDomain if ADFS federation metadata needs refreshing
• Validate federation trust after renewal with a test login

Step 6: Remove the Expired Certificate

Once the new certificate is fully validated across all services:

1. Go back to Certificates & secrets
2. Delete the expired certificate

This avoids confusion and prevents accidental rollbacks.

How to Renew Expired Azure Certificates Without Causing Downtime

To avoid outages during renewal:

1. Upload the new certificate before the old one expires
2. Update applications to use the new certificate
3. Verify authentication and token issuance across all dependent services
4. Remove the old certificate only after full validation

Azure supports multiple active certificates, which makes seamless rollover possible without any authentication gap.

Azure CLI Alternative (For DevOps Teams)

You can reset credentials using Azure CLI. Always use --append to avoid wiping existing certificates:

az ad app credential reset \
  --id <app-id> \
  --cert <path-to-cert> \
  --append

Without --append, this command deletes all existing certificates and secrets on the app registration, causing immediate downtime.

How to Automate Certificate Renewal Using Azure Key Vault

Azure Key Vault removes the risk of manual renewal entirely. Microsoft’s Key Vault certificate management documentation covers advanced policy options in detail. Here is how to set it up:

1. Go to Azure Key Vault > Certificates > Generate/Import
2. Choose Generate and set the subject name to match your app (e.g., CN=AppName)
3. Set the validity period (24 or 36 months recommended)
4. Under Advanced Policy Configuration, enable Auto-Renewal and set a renewal threshold (e.g., 30 days before expiry)
5. Configure Azure Monitor alerts on the Key Vault to notify your team when certificates approach expiry
6. Assign a Managed Identity to your application so it can retrieve certificates without storing credentials in code

Once configured, Key Vault renews certificates automatically and your applications pull the latest version at runtime. This eliminates emergency renewals and reduces operational risk.

Best Practices to Prevent Future Certificate Expiry Issues

• Always add a new certificate before the current one expires
• Use Azure Key Vault for secure storage and automated rotation
• Configure monitoring or alerting for certificate expiry in Azure Monitor
• Prefer 2 to 3 year validity where policy allows
• Maintain a documented renewal SOP for your team

FAQs: Renew Expired Certificates for Azure Authentication

Related Guides

• Can’t Sign In to Microsoft Azure Account? 7 Fixes That Work
• How to Fix AADSTS50058 Error in Azure (Silent Sign-In Request Failed)
• How to Migrate Retiring Azure Virtual Machines to Latest-Generation VMs