For those using Microsoft Entra Application Proxy with custom domains, how are you managing certificate renewals? As far as I can tell, there is no straightforward automated ACME workflow for rotating the certificate bound to the custom domain. Are you handling the roughly 47-day renewal cycle manually, or have you found a reliable automation method? I'm also interested in whether anyone has migrated to another access proxy because of this limitation.
2 Answers
We still rotate them on a schedule because there isn’t a clean ACME path for updating the custom-domain binding. We made it manageable by treating it like a normal certificate runbook: start reminders around day 30, document who controls and transfers the private key, and use a second connector for staged validation when possible. The tricky parts are usually the private-key handoff and confirming that the TLS binding updates without affecting connector trust. Until Microsoft provides automated renewal, I’d plan for this as a recurring operations task. We’ve considered moving away from Application Proxy, but our bigger concerns are session controls and the number of one-off publishing workflows—not certificate rotation alone.
Another option is Cloudflare Zero Trust, but it would be a separate access-proxy solution rather than a way to automate certificates inside Entra Application Proxy. It may be worth evaluating if you’re already unhappy with the renewal process, but it won’t change the limitations of the Microsoft service itself.
That makes sense. I was thinking of alternatives as a possible migration path, not as a way to bypass the certificate-handling rules in Application Proxy.