For those using Microsoft Entra Application Proxy with custom domains, how are you managing certificate renewals? As far as I can tell, there is no straightforward automated ACME workflow for rotating the certificates bound to Application Proxy. I'm wondering whether others have built a solution, accepted the recurring roughly 47-day rotation process, or are considering migrating to another access-proxy platform because of it.
2 Answers
We still rotate the certificates on a schedule because there doesn’t seem to be a clean way to connect ACME renewal directly to the custom-domain binding. We made it less painful by treating it like a formal certificate runbook: start reminders around day 30, document who owns the private key, and use a second connector for staged validation when possible. The riskiest parts are usually transferring the private key and confirming that the custom-domain TLS binding updates without disrupting connector trust. Until Microsoft provides an automated renewal path, I’d plan for this as a recurring operations task. For us, the main reasons to consider moving away from Application Proxy would be broader session-control requirements and too many manual publishing workflows, rather than certificate rotation alone.
One alternative people consider is Cloudflare Zero Trust, although that would be a migration to a different access-proxy solution rather than a way to automate certificates inside Entra Application Proxy.
Right, it wouldn’t override Entra’s certificate limitations. It’s simply a separate platform with its own certificate and publishing model, so it only makes sense if the broader feature set and operational model are a better fit.