Azure certificate authority, CRL and OCSP endpoints

This page's changes and edits · All guidance changes

Microsoft's edit · 28 Aug 16:43 UTC

Clarify allowlist maintenance and align certificate pinning guidance

Microsoft's commit message in MicrosoftDocs/azure-docs · commit a024e84 · +5 −3 lines · also on GitHub

⋯ 5 unchanged lines

66 ms.subservice: security-fundamentals

77 ms.custom: devx-track-extended-java

88 ms.topic: concept-article

9 −ms.date: 04/29/2026

9 +ms.date: 08/28/2026

1010 author: msmbaldwin

1111 ms.author: mbaldwin

1212 manager: femila

⋯ 182 unchanged lines

195195

196196 ## Certificate downloads and revocation lists

197197

198 −To optimize connectivity, add the following domains (HTTP on port 80) to your firewall allowlist:

198 +To optimize connectivity, add the following domains (HTTP on port 80) to your firewall allowlist. These domains serve Authority Information Access (AIA), certificate revocation list (CRL), and Online Certificate Status Protocol (OCSP) requests. The certificate revocation and chain-building standards define these requests as HTTP rather than HTTPS, so port 80 is expected.

199199

200 +This article is the authoritative list of these domains. When Azure adds or removes a certificate authority, it updates the corresponding AIA, CRL, and OCSP domains here and records the change in the [Article change log](#article-change-log). If your environment restricts outbound connectivity by fully qualified domain name (FQDN), monitor this article and the change log so that you can update your firewall allowlist.

201 +

200202 AIA:

201203 - `cacerts.digicert.com`

202204 - `cacerts.digicert.cn`

⋯ 14 unchanged lines

217219

218220 ## Certificate pinning

219221

220 −Certificate pinning is a security technique where you accept only authorized, or *pinned*, certificates when establishing a secure session. The process rejects any attempt to establish a secure session using a different certificate. For more information, see [certificate pinning](certificate-pinning.md).

222 +Certificate pinning is a security technique where you accept only authorized, or *pinned*, certificates when establishing a secure session. The process rejects any attempt to establish a secure session using a different certificate. For publicly trusted TLS certificates used by Azure services, Microsoft generally doesn't recommend static certificate pinning. For more information, see [Certificate pinning](certificate-pinning.md).

221223

222224 ### How to address certificate pinning

223225

⋯ 158 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 00:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.