Unable to create management certificate in AZURE API MANAGEMENT even after mentioned time

Mohamed Farees M 25 Reputation points
2026-07-20T07:46:14.2633333+00:00

API Management will suspend creation of managed certificates from August 15, 2025 to June 30, 2026, to migrate to a platform that meets Multi-Perspective Issuance Corroboration (MPIC) security requirements for issuing certificates. Existing managed certificates will be auto-renewed before the suspension date and continue to function normally. Learn more

To reproduce, Go to Azure API Management you have created and goto custom domain, click Add -> In certificate choose Managed (Preview) you should see above warning and it wont allow you to create it. earlier before Aug 15 we were using that it was working fine, though they say existing wont be impacted, we got impacted and we used different solution. Now since time is over still unable to use it

Azure API Management
Azure API Management

An Azure service that provides a hybrid, multi-cloud management platform for APIs.

0 comments

Answer accepted by question author

Rukmini 43,815 Reputation points Microsoft External Staff Moderator
2026-07-20T07:54:52.3366667+00:00

Hello @Mohamed Farees M

 Hey Mohamed — I see what you’re running into. Based on the info you shared, this looks consistent with the managed certificate creation being temporarily suspended for APIM custom domains during the migration window (Aug 15, 2025 → Jun 30, 2026) and the behavior you describe (Portal showing the warning and blocking creation).

  • During the suspension period, when you go to APIM → Custom domains → Add → Managed (Preview), the portal will show that managed-certificate request is temporarily not supported.
  • Per the published change, existing managed certificates are expected to auto-renew and continue working normally, but new managed certificates can’t be created during the suspension window.

So even if you’re past the end date, if the backend feature flag/backend capability hasn’t been re-enabled yet in your tenant/region, you may still see the same “can’t create managed certificates” behavior.

As a workaround:

Since the portal managed option is blocked, the supported workaround is to bring your own certificate:

  • Obtain a certificate from a trusted third-party (for example, DigiCert/Let’s Encrypt) and upload it to APIM for the custom domain.
  • Your certificate can be uploaded directly in APIM as a .pfx (includes private key), or referenced from Azure Key Vault (recommended approach for certificate handling).

If your APIM is in a restricted network setup (or you’re relying on certificate revocation/renewal connectivity), ensure that:

  • Port 80 access is allowed to the APIM instance from the ApiManagement service tag, because the change doc calls out that port 80 access is required for CRL checks, renewal, and management communication.

The community and KB content you referenced indicates the managed-certificate capability is controlled as a platform change and may not instantly flip back exactly at the date for every customer. If you confirm the portal still blocks creation with the same message after Jun 30, 2026, it’s likely a feature availability/back-end re-enable issue rather than something you misconfigured.

Hello @Mohamed Farees M If the assistance was helpful, kindly take a moment to click on 210246-screenshot-2021-12-10-121802.pngand click on Yes for was this answer helpful. And, if you have any further query do let us know.

Was this answer helpful?

1 person found this answer helpful.

Answer recommended by moderator

TP 160.7K Reputation points Volunteer Moderator
2026-07-20T09:54:45.28+00:00

Hi,

Unfortunately you currently cannot create a managed certificate for Azure API Management.

As I believe you already know, you need to obtain a certificate for your custom domain from a trusted third-party provider and upload this for APIM. For example, you could obtain a free certificate from Let's Encrypt and upload the certificate and its private key (as .pfx file) to APIM. Or you could purchase a certificate and do the same thing.

Managed certificates functionality was supposed to be available again after March 15, 2026, then it was extended to June 30, 2026, but now that deadline has passed and it still isn't available.

Below article provides details on adding custom domain and uploading Custom certificate as .pfx file using portal:

Set a custom domain name - portal

https://learn.microsoft.com/en-us/azure/api-management/configure-custom-domain?tabs=custom#set-a-custom-domain-name---portal

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Was this answer helpful?

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. saleha mubeen 5 Reputation points
    2026-07-20T12:05:33.8966667+00:00

    Based on Microsoft's announcement, managed certificate creation was expected to resume after the migration period. If you're still seeing the suspension message after the stated end date, it's possible the feature hasn't been fully re-enabled in your region or subscription yet, or the documentation hasn't been updated.

    I'd recommend checking the latest Azure API Management service health and release notes, and if there are no known issues, opening a Microsoft support ticket. It would also help to mention your API Management service tier, Azure region, and whether this is a newly created APIM instance or an existing one, as others may be able to verify if they're seeing the same behavior.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-07-20T07:46:36.3733333+00:00

    The behavior is expected. Creation of Azure-managed certificates for custom domains in Azure API Management is still suspended, and the suspension was extended to June 30, 2026.

    What is supported now:

    • Existing managed certificates can still be autorenewed.
    • New managed certificate creation for custom domains remains unavailable during the suspension period.
    • During this period, custom domains can still be configured by using customer-managed certificates from other sources.

    For the scenario described, the practical options are:

    1. Use a customer-managed certificate for the APIM custom domain.
      • Upload a certificate you manage yourself, such as a PFX.
      • Or use another supported certificate source for the custom domain configuration.
    2. If relying on an existing managed certificate, make sure renewal prerequisites are met:
      • Allow inbound traffic from DigiCert IP addresses on port 80.
      • Ensure DNS records for the custom domain resolve correctly.
      • If network restrictions exist, allow the ApiManagement service tag on port 80 in the subnet NSG.
    3. If the feature is still unavailable after the documented suspension window ends, raise a support request.

    Important details from the documentation:

    • Starting January 2026, APIM needs inbound access on port 80 from specific DigiCert IP addresses to renew managed certificates.
    • In classic tiers, managed certificates are a preview feature.
    • Managed certificates are not supported in v2 tiers.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.