Did Microsoft forget to renew digicert certificate

Hello @Hassan Mohd

So renewing certs wouldn't fix your containers, and your container error isn't a symptom of the cert rotation. They're two different failures.

What I'd verify on your side

If any of your own apps/containers talk to Azure and now throw TLS errors → check for cert pinning to an intermediate CA and repoint to the DigiCert Global Root G2 root.

Your ACI issue → fix with the explicit --registry-login-server CLI command from my previous reply (Portal workaround), unrelated to certs.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

@Allan Solomon Mejia thanks for the details Yes its an intermediate certificate thats exipiring in hours from now today 25th August.

CN= Microsoft Azure RSA TLS Issuing CA 7, O=Microsoft Corporation, C=US.

Issuer: CN= Digicert global root G2, OU=www.digicert.com, ODigicert Inc, C=US

Valid from 08.06.2023 to 25.08.2026

RSA 4096

Thanks.

Hello @Hassan Mohd

If you're referring to Microsoft Azure RSA TLS Issuing CA 07 or Microsoft Azure ECC TLS Issuing CA 07, I wouldn't conclude that Microsoft forgot to renew a DigiCert certificate.

These are intermediate Certificate Authority certificates, not the individual TLS/server certificate for an Azure VM or service endpoint.

Microsoft's current Azure CA documentation still lists both Microsoft Azure RSA TLS Issuing CA 07 and Microsoft Azure ECC TLS Issuing CA 07 as part of Azure's certificate infrastructure.

However, an important timing detail may explain what you're seeing. The DigiCert-signed versions of several Microsoft Azure TLS issuing CAs, including CA 07, have certificates that expire around August 25, 2026. Certificate-authority records show this for both the RSA and ECC CA 07 chains.

That doesn't automatically mean Azure TLS will stop working when that intermediate expires. Microsoft maintains multiple Azure CA chains/cross-signed certificates and rotates its PKI infrastructure. Microsoft's current CA documentation, for example, lists both Microsoft-rooted and cross-signed variants of Azure RSA/ECC TLS Issuing CA 07.

So the key question is which Azure endpoint is actually showing the certificate problem.

Could you provide the affected hostname/FQDN and, preferably, the certificate chain you're receiving? For example:

openssl s_client -connect <hostname>:443 -servername <hostname> -showcerts

or, from Windows:

curl.exe -v https://<hostname>/

Please redact anything sensitive, but keep the following certificate information:

Subject, Issuer, Not Before, Not After, Serial Number, and Certificate chain

If the leaf certificate presented by an Azure-managed endpoint has expired, that's a service-side certificate issue and should be escalated immediately.

If you're instead seeing an upcoming/expired Microsoft Azure TLS Issuing CA 07 intermediate in a local certificate store, scanner, firewall, proxy, or vulnerability report, that alone doesn't indicate an Azure outage or failed renewal. We'd need to inspect the certificate chain actually being served by the affected endpoint.

Microsoft's current CA information is here:

Microsoft – Azure Certificate Authority details

If you can post the hostname and the certificate's Subject, Issuer, and expiration date, we can determine whether you're seeing the expected Azure CA rotation or an actual expired certificate being served.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.