APIM Managed certificates - not working

Hi @Neeldip Barot

Thank you for reaching out to Microsoft Q&A.

The message you are seeing is expected behavior and indicates a platform wide suspension of new APIM managed certificate creation, not an issue specific to your API Management instance. Microsoft has temporarily suspended the creation of Azure-managed certificates for APIM custom domains from August 15, 2025, through June 30, 2026, due to industry-wide changes in certificate domain validation requirements. Specifically, the Certificate Authority (DigiCert) is migrating to a new validation platform that complies with Multi-Perspective Issuance Corroboration (MPIC) requirements. During this migration period, APIM cannot issue new managed certificates. Existing managed certificates continue to function and can be renewed under the documented conditions.

Refer below points to understand and resolve the situation:

1. This is not a service incident or configuration issue

If you attempt to create a new APIM managed certificate today, the operation is blocked by design due to the suspension window. The portal message is informing you of this platform limitation.

2. New managed certificates cannot currently be created

Any new custom domain that requires an APIM-managed certificate cannot use the "Managed Certificate" option until Microsoft re-enables the feature after the suspension period ends.

3. Existing managed certificates are not affected

If you already had a managed certificate configured before the suspension period, it should continue to function normally. Microsoft documentation states that existing certificates can continue to be renewed provided the required APIM and DNS prerequisites are met.

4. Recommended workaround: Use your own certificate

If you need to configure a custom domain immediately, Microsoft recommends using one of the following:

• Certificate stored in Azure Key Vault
• Certificate purchased from a public Certificate Authority
• Let's Encrypt certificate managed outside APIM

You can then bind that certificate to the APIM custom domain instead of using the APIM-managed certificate option.

5. If using Key Vault certificates

Ensure:

• APIM Managed Identity is enabled.
• APIM has Get and List permissions on Key Vault secrets.
• The certificate is uploaded as a Certificate object in Key Vault.
• A visionless Key Vault secret URI is used for automatic rotation.

6. Official Microsoft Documentation

Microsoft has updated the announcement to show that the suspension period has been extended until June 30, 2026. There's no further update on the new date. I'll let you know once I receive a update from Product team on revised date.

Hi,

Unfortunately you currently cannot create a managed certificate for Azure API Management. You need to obtain a certificate for your custom domain from a trusted third-party provider and upload this for APIM. For example, you could obtain a free certificate from Let's Encrypt and upload the certificate and its private key (as .pfx file) to APIM. Or you could purchase a certificate and do the same thing.

Managed certificates functionality was supposed to be available again after March 15, 2026, then it was extended to June 30, 2026, but now that deadline has passed and it still isn't available.

Below article provides details on adding custom domain and uploading Custom certificate as .pfx file using portal:

Set a custom domain name - portal

https://learn.microsoft.com/en-us/azure/api-management/configure-custom-domain?tabs=custom#set-a-custom-domain-name---portal

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP