Loading
Latest posts
Your Intune Compliance Is Moving to Azure Attestation… and Your Firewall Might Break it
Microsoft is Unifying the Copilot Apps… What IT Admins need to know before September 2026
Remove Device Everywhere – Because Microsoft Thought 3 Portals Was a Good Idea
I Asked Copilot To Make ASCII Art… and It Broke My Soul
AZ-140 Renewal 2025 – What Microsoft Really Tested (and what they didn’t)
Related posts
- Your Intune Compliance Is Moving to Azure Attestation… and Your Firewall Might Break it
- Microsoft is Unifying the Copilot Apps… What IT Admins need to know before September 2026
- Remove Device Everywhere – Because Microsoft Thought 3 Portals Was a Good Idea
- I Asked Copilot To Make ASCII Art… and It Broke My Soul
- AZ-140 Renewal 2025 – What Microsoft Really Tested (and what they didn’t)
Azure IMDS Certificate Changes in 2026.. Don’t panic (Unless you should)
Engin Soysal
Hey You
Microsoft did it again. On November 25th, I opened my inbox, minding my own business, drinking my coffee (Irish off course), ready for a normal day…
… and then I saw it:
Great… fantastic… I love chaos before 09:00.
But… before we start rewriting our entire cloud architecture… RELAX.
Let me break down what this actually means, why Microsoft is doing this, who’s impacted and how to figure you if YOU need to take action… or if you can safely keep scrolling LinkedIn instead.
So… what is happening?
Starting January 2026, Azure will begin rolling out new Subordinate Certificate Authorities (Sub CAs) used by the Azure Instance Metadata Service (IMDS).
The current Sub CAs expire in April 2026.
This affects all Azure Clouds… commercial, government, national cloud… EVERYTHING!!! As confirmed in the official Microsoft blog.
But here’s the important part straight from the email
Most customers don’t need to take action
Translation: If your application does NOT use certificate pinning… you can chill. If it DOES… well… welcome to the 5% Club of Pain
Why is Microsoft doing this?
2 big reasons…
1. Browser root store changes
On April 15, 2026, Chrome and Firefox will distrust the DigiCert Global Root G1. So Microsoft must rotate to new roots and intermediates
2. Certificate lifetime reduction
IMDS certificates are moving from 180-day to 100-day lifetimes. More secure, more rotation… more chances something breaks at 3 AM.
Yay…
Here’s the ONLY question that matters: Do you use certificate pinning?
If yes => you MUST update your certificate list before January 2026.
If not => you can ignore this entire blog… but read it anyway because we both know you’re curious.
The Certificate Pinning doc explains it clearly: Certificate pinning happens when developers hardcode or restrict trusted certificates things like:
- Thumbprints
- Serial numbers
- Subject Distinguished Names
- Common Names
- does this list still keep going?
- Public keys
- Intermediate CA lists
- Custom Trust stores
- Anything that says “ONLY accept THESE certificates”
If you do ANY of that… you’re impacted. If your app just trusts the OS root store => you’re fine.
The new certificate list (a.k.a. “The table of DOOM”)
Microsoft published a MASSIVE (that’s what she said) list of new and existing CA certificates used across Azure services. It includes:
- New intermediates
- Removed intermediates
- Root CAs
- OSCP responders
- Regional changes
- Historical rotations going back to 2023
If you rely on pinned intermediates => you must add ALL new ones from that list. If you pinned only root CAs, you’re probably safe… but… still double check.
Timeline (IMPORTANT!!!)
Microsoft’s rollout goes like this
- January 6, 2026 => East US 2 EUAP, Central US EUAP, West Central US, East Asia
- January 23, 2026 => UK South
- February 1, 2026 => All remaining regions
All clouds finish rotation by April 2026, when old Sub CAs expire.
If your app uses certificate pinning: Here’s what you must do
Based on Microsoft’s guidance:
1. Scan your code
Search for:
- Hardcoded thumbprints
- Serial numbers
- CN/SAN checks
- Public key pinning
- Custom CA bundles
- Intermediate CA references
If ANY appear => you pin certificates
2. Add ALL new Sub CAs
From the CA list. Not just the ones you see today. ALL of them.
3. Keep both old and new CAs until April 2026
This is explicitly required to avoid downtime.
4. Update your trust store
For:
- Windows
- Linux (/etc/ssl/certs)
- Java (use keytool command)
5. Add fallback logic
Microsoft even recommends it:
Create fallback logic to minimize future impact
You’ll thank yourself later.
If you do NOT use certificate pinning
Congratulations. You belong to the lucky 95%. Your workload will continue to function normally, and Microsoft’s own words apply
You can ignore this message
Close this tab. Drink your coffee. Finish your day in peace.
Should you STOP using certificate pinning?
Short answer? YES!
Microsoft says it plainly in the pinning doc
We recommend discontinuing certificate pinning
Pinning is fragile in 2025 and later. Intermediates rotate often… roots change… OSCP responders shit… (I meant to write shift… after rereading this part I actually laughed a bit… So… I’m keeping it)… You become the weakest link in your own architecture.
If you MUST pin => pin only the root CA. Pinning intermediates is a one-way ticket to outage-ville.
TL;DR
- Azure IMDS is changing its TLS certificate in January 2026.
- Old Sub CAs expire in April 2026
- 95% of customers don’t need to do anything
- If you pin certificates => update your CA list NOW!
- Pinning is discouraged
- Timeline varies by region
- You’re probably fine… unless you’re not
Final Thoughts
These certificate rotations aren’t sexy. They don’t involve AI… no CoPilot… They don’t even involve YAML (thank god).
But they DO affect production workloads… quietly, suddenly and usually on a Friday afternoon.
So do the one thing future you will thanks for:
- Check your app
- Update your CAs if needed
- And if you can.. stop certificate pinning altogether
Thanks for reading.
Cheers,
Engin
Engin SoysalMicrosoft MVP and Microsoft Certified Trainer, sharing practical experience with Azure, Microsoft Intune and endpoint engineering.
43 stories · read them all
0 Comments