Azure Application Gateway Certificate update with KeyVault integration not working as expected

Question

Azure Application Gateway Certificate update with KeyVault integration not working as expected

Michal Fajta 10

In documentation there is information, that

Any change to Application Gateway forces a check against Key Vault to see if any new versions of certificates are available

https://learn.microsoft.com/en-us/azure/application-gateway/renew-certificates?wt.mc_id=knwlserapi_inproduct_azportal#certificates-on-azure-key-vault

But we have issue, that our certificate will be updated in 1-4h after new version was created in keyvault. But this cannot be triggered by AppGW changes.

Issue is we are reissuing the certificates with new cert provider, so question is if there are special conditions when this certificate update is not triggered for certificate that don't have same thumbprint or have different rootca ?
As this is not documented.

Update:

We are using version less URL for secrets.
AI reply didn't help

Michal Fajta 10 Reputation points

2026-07-15T10:52:35.9566667+00:00

Update: We are using version less URL for secrets.
TP 160.7K Reputation points Volunteer Moderator

2026-07-15T11:15:29.4433333+00:00

Hi Michal,

Are you saying you apply change to your Application Gateway, but it doesn't pick new certificate from key vault? Or are you saying you cannot change your Application Gateway? You could have a tag specifically for this purpose, and update it each time to new value.

1 answer

Your answer

Michal Fajta 10 Reputation points

2026-07-15T10:52:35.9566667+00:00

Update: We are using version less URL for secrets.
TP 160.7K Reputation points Volunteer Moderator

2026-07-15T11:15:29.4433333+00:00

Hi Michal,

Are you saying you apply change to your Application Gateway, but it doesn't pick new certificate from key vault? Or are you saying you cannot change your Application Gateway? You could have a tag specifically for this purpose, and update it each time to new value.

Answer 1

What you are seeing matches a recently clarified behavior. The normal autorotation path is a Key Vault poll every four hours, so a 1–4 hour delay is expected. Although the renewal page says any Application Gateway change triggers a check, Microsoft's newer troubleshooting guidance says that reapplying the same versionless URI—or making an unrelated/empty gateway update—may not force an immediate fetch because keyVaultSecretId did not change.

A different thumbprint, issuer, or root CA is not itself a rotation blocker. The new Key Vault version must still contain a supported, exportable certificate: PFX or PEM with the private key, complete intermediate chain, correct content type, and valid Key Vault access for the gateway's managed identity.

For a deterministic refresh, temporarily change the SSL certificate reference to the latest versioned secret ID, then restore the versionless ID. In CLI terms, run az network application-gateway ssl-cert update first with the latest versioned secret URL, and again with https://<vault>.vault.azure.net/secrets/<certificate>. This changes the value that controls the fetch while preserving future autorotation.

If it still does not rotate, verify the PFX/private key and full chain, identity permissions, Key Vault firewall access, and the gateway provisioning state.

Official guidance:

https://learn.microsoft.com/en-us/azure/application-gateway/renew-certificates#certificates-on-azure-key-vault

https://learn.microsoft.com/en-us/troubleshoot/azure/application-gateway/troubleshoot-application-gateway-key-vault-certificate#resolution-e-application-gateway-serves-an-older-certificate-than-the-current-key-vault-version-autorotation-stalls

Michal Fajta 10 Reputation points

2026-07-18T14:00:09.81+00:00

Hi Christos,

For me it's curious, like I said the certificate works, but I cannot force the auto rotation like we have this in the past. The updated certificate will works, but will be applied in 1-4 hours and we cannot verity that it works with our automation that update certificate, because we don't know how to trigger immediately as doing infrastructure changes or changes to tags don't works, but the certificate in the end will be used.
One issue is, there are no log for this behavior visible to user, what I found is that for example I update tags, then in portal overview page look into JSON configuration, is see on Certificates status -> provisioningState:Updating that they are updating (I don't remember correct naming now).

So issue that It don't work anymore like in the past, and I don't know why.
We could probably do the suggested changes, change the cert reference to the latest versioned and then maybe rerun our AppGW infrastructure pipeline, but for me this looks like a hotfix for issue without doing proper RCA. Not sure why autorotation is working when we wait for 1-4 hour but don't work we we trigger it with changes to appGW.