# Keep pipeline client certificates inside the managed CA rotation window

> What renewal and placement constraints apply to clients using Azure Monitor pipeline's managed certificate issuer?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-519-keep-pipeline-client-certificates-inside-the-managed-ca-rotation-window/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:23:17+00:00
- Modified: 2026-09-10T02:11:18+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

What renewal and placement constraints apply to clients using Azure Monitor pipeline's managed certificate issuer?

## Potentially affected

Intra-cluster clients using automated certificate management for Azure Monitor pipeline on Arc-enabled Kubernetes.

## DSE recommendation

Check client renewal timing and namespace trust-bundle delivery together before relying on managed mTLS rotation.

## Article

## Source facts

Azure Monitor pipeline’s managed client certificates must renew within two days; otherwise a CA rotation can invalidate them. Microsoft supplies duration and renewBefore combinations designed to meet that constraint. Certificates from the managed client issuer are for clients inside the same Kubernetes cluster, not external clients, which should use a gateway. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-tls-automated).

Client namespaces must be labeled to receive the server CA trust-bundle ConfigMap. The operator updates that bundle during certificate rotation. Server leaf certificates have a 48-hour lifetime and renew 24 hours before expiry. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-tls-automated).

## Applicability

Review intra-cluster clients using automated certificate management for Azure Monitor pipeline on Arc-enabled Kubernetes. Confirm the pipeline’s prerequisites and client placement before using its managed issuer; this is not a general external-device certificate design.

## DSE recommendation

DSE recommends reviewing the client’s renewal schedule and trust delivery as one configuration. Compare duration and renewBefore with the documented two-day renewal constraint, rather than checking only the printed expiry date. Confirm that the intended client namespace receives the managed trust bundle. Keep external clients on the separately approved gateway path instead of exporting an intra-cluster identity for convenience.

## Verification

In a controlled test, observe issuance, renewal and trust-bundle updates while checking successful client connections. Verify that the client uses the replacement certificate and current trust material. Preserve certificate identifiers and timing without private keys. Treat a certificate that still appears unexpired but no longer validates after CA rotation as a rotation-path investigation, not a reason to disable peer validation.

## Official references

[Microsoft Learn: Pipeline automated certificate management](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-tls-automated).

## Primary reference

- Name: Azure Monitor pipeline TLS configuration (Automated certificate management) - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-tls-automated
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep pipeline client certificates inside the managed CA rotation window,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-519-keep-pipeline-client-certificates-inside-the-managed-ca-rotation-window/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.