> ## Content Index
> Fetch the complete content index at: https://codeisahighway.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to detect expiring certificates in Azure Application Gateway
- URL: https://codeisahighway.com/how-to-detect-expiring-certificates-in-azure-application-gateway/
- Published: 2019-10-02T20:43:22.000Z
- Updated: 2026-07-17T08:28:14.000Z
- Author: Stephane Lapointe
- Tags: Microsoft Azure, PowerShell, Azure Resource Graph, Azure Resource Manager, HowTo, Audit, Certificates, Https, App Service, #Import 2023-07-11 16:44, #Import 2026-09-04 10:31, #Import 2026-09-04 13:56

We've been on a mission lately at work to find expiring credentials and certificates in our Azure environments. One of the resources we had on our radar is Azure Application Gateway. Here's what I did to solve this problem and to enable us to be more proactive.

Updated: 2021-06-14 - Refreshed modules & script references

### Requirements

- PowerShell Az module
- Az.ResourceGraph module v 0.10.0+

### The problem

It is always stressful to have people landing at your desk, panic in their eyes because some HTTPS certificate just expired in a critical environment. Some resources in Azure are more easily detected than others. Expiring certificates in App Services can be easily detected using only Azure Resource Graph, here's the [recipe](https://github.com/slapointe/azure-quickstart-resource-graph/tree/master/queries/appServices/certificates-expiring-in-90days?ref=codeisahighway.com) if you want it. Others, like Application Gateway cannot be checked only using Resource Graph (at the moment of writing this). 

### The Assumption

My first reflex was to use PowerShell to call Azure Resource Graph to automate this. Basically, I want to extract all certificate information from Azure, decode it from Base64, create the certificate (X509Certificate2) in memory and check the `NotAfter` property against the date I wanted. Well, in the case of Application Gateway, it turned out to be a bit more complicated than I thought.

### The Twist

I tried, and tried for an hour to decode the certificate `publicCertData` property without success. I turned to the internet and found the following PowerShell module: [AzureRMAppGWCert](https://www.powershellgallery.com/packages/AzureRMAppGWCert?ref=codeisahighway.com). A big thank you by the way to **Victor Santana** for this gem. When I examined the code, I understood why it didn't work like I was always doing elsewhere. In the case of Application Gateway, we need to remove some of the data after the base64 conversion.

### The solution

After the tricky truncate part. I created a PowerShell script with Azure Resource Graph to scan all subscriptions you have access to. Here is how to use it:

```
# Default is in the next 90 days
.\Get-AzureAppGatewayExpiringCertificates.ps1

# To look further, i.e. 180 days
.\Get-AzureAppGatewayExpiringCertificates.ps1 -ExpiresInDay 180

```

If you have any expired or soon expiring certificates, you'll have one or more of the following output:

```
Name                           Value
----                           -----
SubscriptionId                 00000000-0000-0000-0000-000000000000
Thumbprint                     4956BCC058BCA4BCB1349357AB474CCDBB37C28AB
ResourceGroup                  poc-prod-common
SubscriptionName               my-company-subscription
NotAfter                       3/4/2019 4:51:03 PM
Cert                           [Subject]...
Name                           poc-prod-common-ag
```

### Conclusion

Again, the truncate thing was a nice pitfall, but very glad I finally worked it out with the help of Azure Resource Graph. In my case I scan 30+ subscriptions and check all of them in under 3 seconds which is blazing fast!

You can download the script from my azure-scripts repo on GitHub [here](https://github.com/slapointe/azure-scripts/tree/master/application-gateway?ref=codeisahighway.com). Enjoy!

Hope it help!