Share via

Impact of July 2025 Managed Certificate Changes on Traffic Manager Integration

Hiten Samalia 20 Reputation points
2025-08-11T12:19:57.9866667+00:00

My Azure Function App / Web App relies on Traffic Manager (priority-based) to route HTTP traffic across different regions.

According to the Microsoft documentation, we will no longer be able to create certificates for *.trafficmanager.net domains. Until now, this was possible.

If I follow the recommended steps in the guide—creating a custom domain, adding the CNAME to the Traffic Manager domain, and adding that domain in the App Service Custom Domains section (with a certificate generated by App Service Managed Certificates)—my App Service shows as Degraded in the Traffic Manager profile.

How can I prevent this?

In the Traffic Manager documentation, it states:

"Since the App Service app is now integrated with a Traffic Manager endpoint, you should see the Traffic Manager domain name under CNAME configuration. Select it and click Add custom domain."

If I do this, a managed certificate is created automatically (which should not be the case as mentioned in App Service Managed Certificate (ASMC) changes – July 28, 2025), which is the expected behavior. However, if I skip this step, the app shows as Degraded in the Traffic Manager profile, and traffic is not routed.

Am I doing something wrong or interpreting the documentation incorrectly?

Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Shree Hima Bindu Maganti 5,480 Reputation points Microsoft External Staff Moderator
    2025-08-28T08:58:06.4233333+00:00

    Hi @Hiten Samalia
    Apology for your inconveniences
    To handle the binding of the Traffic Manager's custom domain in the App Service, you should be aware of the upcoming changes to App Service Managed Certificates (ASMC) that will take effect on July 28, 2025. These changes will impact how certificates are issued and renewed, particularly for domains associated with Traffic Manager.

    Since you cannot create a certificate for the *.trafficmanager.net domain, it is recommended to configure a custom domain that points to your Traffic Manager endpoint and secure it with your own certificate. You will need to:

    1. Acquire a certificate for your custom domain from any certificate provider that meets your requirements.
    2. Add the certificate to your App Service.
    3. Create a custom domain binding to ensure that your App Service can use the custom domain securely.

    If your Traffic Manager profile is functioning correctly and the Monitor Status is as expected, you may not need to make immediate changes. However, it is crucial to plan for the certificate acquisition and binding process to comply with the new requirements by the specified date.

    References:

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.