Azure certificate authority, CRL and OCSP endpoints

This page's changes and edits · All guidance changes

Microsoft's edit · 10 Sep 22:29 UTC

Accept LAA suggestions: allowlist -> allow list (per Microsoft Style Guide)

Microsoft's commit message in MicrosoftDocs/azure-docs · commit 97a5b73 · +4 −4 lines · also on GitHub

⋯ 5 unchanged lines

66 ms.subservice: security-fundamentals

77 ms.custom: devx-track-extended-java

88 ms.topic: concept-article

9 −ms.date: 08/28/2026

9 +ms.date: 09/10/2026

1010 author: msmbaldwin

1111 ms.author: mbaldwin

1212 manager: femila

⋯ 3 unchanged lines

1616

1717 # Azure Certificate Authority details

1818

19 −This article outlines the specific root and subordinate Certificate Authorities (CAs) that Azure service endpoints use. This CA list is distinct from the trust anchors on Azure VMs and hosted services, which use the trust anchors provided by the operating systems. The scope includes government and national clouds. The sections after the CA details tables provide the minimum requirements for public key encryption and signature algorithms, links to certificate downloads and revocation lists, and information about key concepts. These sections also provide the host names for the URIs that you should add to your firewall allowlists.

19 +This article outlines the specific root and subordinate Certificate Authorities (CAs) that Azure service endpoints use. This CA list is distinct from the trust anchors on Azure VMs and hosted services, which use the trust anchors provided by the operating systems. The scope includes government and national clouds. The sections after the CA details tables provide the minimum requirements for public key encryption and signature algorithms, links to certificate downloads and revocation lists, and information about key concepts. These sections also provide the host names for the URIs that you should add to your firewall allow lists.

2020

2121 ## Certificate Authority details

2222

⋯ 172 unchanged lines

195195

196196 ## Certificate downloads and revocation lists

197197

198 −To optimize connectivity, add the following domains (HTTP on port 80) to your firewall allowlist. These domains serve Authority Information Access (AIA), certificate revocation list (CRL), and Online Certificate Status Protocol (OCSP) requests. The certificate revocation and chain-building standards define these requests as HTTP rather than HTTPS, so port 80 is expected.

198 +To optimize connectivity, add the following domains (HTTP on port 80) to your firewall allow list. These domains serve Authority Information Access (AIA), certificate revocation list (CRL), and Online Certificate Status Protocol (OCSP) requests. The certificate revocation and chain-building standards define these requests as HTTP rather than HTTPS, so port 80 is expected.

199199

200 −This article is the authoritative list of these domains. When Azure adds or removes a certificate authority, it updates the corresponding AIA, CRL, and OCSP domains here and records the change in the [Article change log](#article-change-log). If your environment restricts outbound connectivity by fully qualified domain name (FQDN), monitor this article and the change log so that you can update your firewall allowlist.

200 +This article is the authoritative list of these domains. When Azure adds or removes a certificate authority, it updates the corresponding AIA, CRL, and OCSP domains here and records the change in the [Article change log](#article-change-log). If your environment restricts outbound connectivity by fully qualified domain name (FQDN), monitor this article and the change log so that you can update your firewall allow list.

201201

202202 AIA:

203203 - `cacerts.digicert.com`

⋯ 180 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.