Flex Consumption introduces a site-scoped certificate model in
public preview in all the regions where Flex Consumption is available. Unlike
webspace-scoped certificates on other hosting plans which are shared across
apps in the same region + resource group, Flex certificates are scoped to an
individual function app.
Each function app can hold up to 3 private
(.pfx) and 3 public (.cer) certificates uploaded directly, imported from Azure
Key Vault, or issued as free App Service Managed Certificates to enable custom
domains, client-certificate authentication, and mutual TLS scenarios on Flex
Consumption.
To access certificates from
code Flex Consumption
uses a per-certificate "Accessible to app code" toggle
in the portal instead of the WEBSITE_LOAD_CERTIFICATES app setting used on other plans. Because Flex
Consumption runs on Linux, code reads certificates from file paths (/var/ssl/certs for public, /var/ssl/private for private) rather than from a Windows certificate
store.
Currently, the Azure portal is the
recommended path for configuring certificates during preview. Apps migrating
from another plan should add their certificates to the new Flex Consumption app
rather than carrying webspace-scoped certificates across.
Learn more: