|
| 1 | +--- |
| 2 | +author: dlepow |
| 3 | +ms.service: azure-api-management |
| 4 | +ms.topic: include |
| 5 | +ms.date: 01/28/2026 |
| 6 | +ms.author: danlep |
| 7 | +ms.custom: |
| 8 | +--- |
| 9 | + |
| 10 | +### Allow access to DigiCert IP addresses |
| 11 | + |
| 12 | +Starting January 2026, Azure API Management needs inbound access on port 80 to [specific DigiCert IP addresses](https://knowledge.digicert.com/alerts/ip-address-domain-validation?utm_medium=organic&utm_source=docs-digicert&referrer=https://docs.digicert.com/en/certcentral/manage-certificates/domain-control-validation-methods/automatic-domain-control-validation-check.html) to renew (rotate) your managed certificate. |
| 13 | + |
| 14 | +If your API Management instance restricts incoming IP addresses, we recommend that you remove or modify existing IP restrictions by using one of the following methods based on your deployment architecture. |
| 15 | + |
| 16 | +> [!NOTE] |
| 17 | +> Any time you make changes to policy configurations, network security groups, or firewall rules, it's recommended to test access to your APIs to confirm the restrictions have been removed as intended. |
| 18 | +
|
| 19 | +### Remove or edit IP filter policies in API Management |
| 20 | + |
| 21 | +If you implemented IP address restrictions by using built-in policies such as [ip-filter](../articles/api-management/ip-filter-policy.md): |
| 22 | + |
| 23 | +1. Sign in to the Azure portal and go to your API Management instance. |
| 24 | +1. Under **APIs**, select the API where the policy applies (or **All APIs** for a global change). |
| 25 | +1. On the **Design** tab, in **Inbound processing**, select the code editor (`</>`) icon. |
| 26 | +1. Locate the IP restriction policy statement. |
| 27 | +1. Do one of the following: |
| 28 | + - Delete the entire XML snippet to remove the restriction completely. |
| 29 | + - Edit the elements to include or remove specific IP addresses or ranges as needed. We recommend that you add the DigiCert IP addresses to the allow list. |
| 30 | +1. Select **Save** to apply changes immediately to the gateway. |
| 31 | + |
| 32 | +### Modify network security group rules (external virtual network deployment) |
| 33 | + |
| 34 | +If you deploy your API Management instance in a [virtual network in external mode](../articles/api-management/api-management-using-with-vnet.md), inbound IP restrictions are typically managed using network security group rules on the subnet. |
| 35 | + |
| 36 | +To modify the network security group that you configured on the subnet: |
| 37 | + |
| 38 | +1. In the Azure portal, go to **Network security groups**. |
| 39 | +1. Select the network security group associated with your API Management subnet. |
| 40 | +1. Under **Settings** > **Inbound security rules**, locate rules that are enforcing the IP restriction (for example, rules with a specific source IP range or service tag that you want to remove or broaden). |
| 41 | +1. Do one of the following: |
| 42 | + - **Delete** the restrictive rule: Select the rule and choose the **Delete** option. |
| 43 | + - **Edit the rule**: Change **Source** to **IP Addresses** and add the DigiCert IP addresses to the allow list on port 80. |
| 44 | +1. Select **Save**. |
| 45 | + |
| 46 | +### Internal virtual network deployment |
| 47 | + |
| 48 | +If your API Management instance is deployed in a [virtual network in internal mode](../articles/api-management/api-management-using-with-internal-vnet.md) and is connected with Azure Application Gateway, Azure Front Door, or Azure Traffic Manager, then you need to implement the following architecture: |
| 49 | + |
| 50 | +Azure Front Door / Traffic Manager → Application Gateway → API Management (internal virtual network) |
| 51 | + |
| 52 | +Both the Application Gateway and API Management instances must be injected in the same virtual network. [Learn more about integrating Application Gateway with API Management](../articles/api-management/api-management-howto-integrate-internal-vnet-appgateway.md). |
| 53 | + |
| 54 | +**Step 1: Configure Application Gateway in front of API Management and allow DigiCert IP addresses in network security group** |
| 55 | + |
| 56 | +1. In the Azure portal, go to **Network security groups** and select the network security group for your API Management subnet. |
| 57 | +1. Under **Settings** > **Inbound security rules**, locate rules that are enforcing the IP restriction (for example, rules with a specific source IP range or service tag that you want to remove or broaden). |
| 58 | +1. Do one of the following: |
| 59 | + - **Delete** the restrictive rule: Select the rule and choose the **Delete** option. |
| 60 | + - **Edit the rule**: Change **Source** to **IP Addresses** and add the DigiCert IP addresses to the allow list on port 80. |
| 61 | +1. Select **Save**. |
| 62 | + |
| 63 | +**Step 2: Preserve target custom domain/hostname from the traffic manager through to the API Management instance** |
| 64 | + |
| 65 | +Do one or more of the following based on your deployment: |
| 66 | + |
| 67 | +- Configure Azure Front Door to preserve the host header (forward the original host header). |
| 68 | + - **Azure Front Door (classic):** Set **Backend host header** to the API Management hostname (not the Application Gateway FQDN), or select **Preserve the incoming host header** when using custom domains. |
| 69 | + - **Azure Front Door Standard/Premium:** In **Route > Origin > Origin settings**, enable **Forward Host Header** and select **Original host header**. |
| 70 | + |
| 71 | +- Configure Application Gateway to preserve the host header. |
| 72 | + |
| 73 | + In **HTTP settings**, do one of the following to ensure that Application Gateway acts as a reverse proxy without rewriting the host header: |
| 74 | + |
| 75 | + - Set **Override host name** to **No**. |
| 76 | + - If you use hostname override, set **Pick hostname from incoming request** (recommended). |
| 77 | + |
| 78 | +- Ensure API Management has a matching custom domain. |
| 79 | + |
| 80 | + API Management in internal virtual network mode still requires the incoming hostname to match an API Management custom domain you configured. |
| 81 | + |
| 82 | + For example: |
| 83 | + |
| 84 | + | Layer | Host header | |
| 85 | + |-------|-------------| |
| 86 | + | Client → Azure Front Door | `api.contoso.com` | |
| 87 | + | Azure Front Door → Application Gateway | `api.contoso.com` | |
| 88 | + | Application Gateway → API Management | `api.contoso.com` | |
| 89 | + |
| 90 | + API Management rejects requests if the incoming hostname doesn't match a configured custom domain. |
| 91 | + |
| 92 | + > [!IMPORTANT] |
| 93 | + > If you configured a free, managed certificate on Azure Front Door on the same domain `api.contoso.com`, then you can't use the free, managed certificate feature of API management. Instead, we recommend bringing your own certificate and uploading it to API Management for the custom domain. |
| 94 | +
|
| 95 | +### Modify Azure Firewall rules if used |
| 96 | + |
| 97 | +If an Azure Firewall protects your API Management instance, modify the firewall's network rules to allow inbound access from DigiCert IP addresses on port 80: |
| 98 | + |
| 99 | +1. Go to your **Azure Firewall** instance. |
| 100 | +1. Under **Settings** > **Rules** (or **Network rules**), locate the rule collection and the specific rule that restricts inbound access to the API Management instance. |
| 101 | +1. Edit or delete the rule to add the DigiCert IP addresses to the allow list on port 80. |
| 102 | +1. Select **Save** and test API access. |
0 commit comments