`azurerm_application_gateway` - Deprecate `authentication_certificate` property by v-yhyeo0202 · Pull Request #31400 · hashicorp/terraform-provider-azurerm

v-yhyeo0202 · 2025-12-22T01:39:48Z

Community Note

Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

The authentication_certificate property of azurerm_application_gateway resource can only be used with V1 SKU. As application gateway V1 SKU is retired, the application of V1 SKU can cause the error as shown in the log below when running acceptance test. Hence, authentication_certificate is deprecated in this PR.

    testcase.go:173: Step 1/6 error: Error running apply: exit status 1
        Error: creating Application Gateway (Subscription: "*******"
        Resource Group Name: "acctestRG-251219203556636178"
        Application Gateway Name: "acctestag-251219203556636178"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: ApplicationGatewayFeatureCannotBeEnabledForSelectedSku: Application Gateway /subscriptions/*******/resourceGroups/acctestRG-251219203556636178/providers/Microsoft.Network/applicationGateways/acctestag-251219203556636178 does not support AuthenticationCertificates for the selected SKU tier Standard_v2. Supported SKU tiers are Standard,WAF.
          with azurerm_application_gateway.test,
          on terraform_plugin_test.tf line 76, in resource "azurerm_application_gateway" "test":
          76: resource "azurerm_application_gateway" "test" {

PR Checklist

I have followed the guidelines in our Contributing Documentation.
I have checked to ensure there aren't other open Pull Requests for the same update/change.
I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
~~I have written new tests for my resource or datasource changes & updated any relevant documentation.~~
I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
~~(For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.~~

Testing

My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

Acceptance test results are listed below. The tests run are determined with terraform-terracorder. The failed test is due to intermittent error.

Version 4.0
https://hashicorp.teamcity.com/buildConfiguration/TF_AzureRM_AZURERM_SERVICE_PUBLIC_NETWORK/644425?buildTab=overview

Version 5.0
https://hashicorp.teamcity.com/buildConfiguration/TF_AzureRM_AZURERM_SERVICE_PUBLIC_NETWORK/644621?buildTab=overview

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

azurerm_application_gateway - deprecate authentication_certificate property

This is a (please select all that apply):

Bug Fix
New Feature (ie adding a service, resource, or data source)
Enhancement
Breaking Change

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the provider.

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

…d authCertificateUpdated

…ecation notes

…way-authcert-acctest

…perty deprecation

…ime catch

…way-authcert-acctest

…slices

…KU deprecation

…ntation

…` argument

gerrytan

Thanks @v-yhyeo0202 , I noticed this PR has merge conflict with main. Can you please do some investigation if we should still proceed, and resolve the conflict if we do.

gerrytan · 2026-01-20T05:36:05Z

 	})
 }

-func TestAccApplicationGateway_authCertificate(t *testing.T) {


Looks like this test has been removed in main. Can you please gather some info on the corresponding PR that got merged, and assess if we should still proceed with the changes in this PR?

I have checked and found that the PR conflict is not related to the removal of TestAccApplicationGateway_authCertificate. For the removal of TestAccApplicationGateway_authCertificate, actually it is done by me in #31076. When I start this PR, #31076 is not merged yet. Hence, I build this PR on top of #31076 as both of them are related to deprecation of application gateway V1 SKU.

gerrytan

Thanks @v-yhyeo0202 . I left some review comments. It will also help if you still have the link of the failing acctest that shows this property is no longer supported for V2 SKU.

gerrytan · 2026-02-18T05:20:39Z


 * `authentication_certificate` - (Optional) One or more `authentication_certificate_backend` blocks as defined below.

+-> **Note:** `backend_http_settings.authentication_certificate` has been deprecated in accordance with the [deprecation of Application Gateway V1](https://aka.ms/V1retirement) and will be removed in v5.0 of the AzureRM Provider.


Can we use this MS Learn link instead, it provides more info about authentication_cert deprecation: https://learn.microsoft.com/azure/application-gateway/ssl-overview#end-to-end-tls-with-the-v2-sku

The link has been updated.

gerrytan · 2026-02-18T05:41:33Z

+### `azurerm_application_gateway`
+
+* The `backend_http_settings.authentication_certificate` property has been removed.
+* The `authentication_certificate` property has been removed.


Minor: missing a newline underneath

A newline is added.

gerrytan · 2026-02-18T05:46:08Z

+		resource.Schema["backend_http_settings"].Elem.(*pluginsdk.Resource).Schema["authentication_certificate"] = &pluginsdk.Schema{
+			Type:     pluginsdk.TypeList,
+			Optional: true,
+			Computed: true,


Why do we set it computed here? It was not computed before. Same with authentication_certificate below.

Sorry, I was confused over the practice to add Computed behaviour when renaming a property as indicated in the contributor guideline. Since the property is removed, not renamed, the Computed behaviour is removed.

v-yhyeo0202 · 2026-02-20T00:58:51Z

Thanks @v-yhyeo0202 . I left some review comments. It will also help if you still have the link of the failing acctest that shows this property is no longer supported for V2 SKU.

Thanks Gerry for the review, the link of failing acctest has been added here and in description.

v-yhyeo0202 · 2026-02-20T01:14:28Z

Acceptance test results are listed below. The tests run are determined with terraform-terracorder. The failed tests are due to pre-existing or intermittent errors.

Version 4.0
Version 5.0

v-yhyeo0202 · 2026-04-08T06:35:26Z

Latest test results. The failed test is due to intermittent error.

Version 4.0
https://hashicorp.teamcity.com/buildConfiguration/TF_AzureRM_AZURERM_SERVICE_PUBLIC_NETWORK/644425?buildTab=overview

Version 5.0
https://hashicorp.teamcity.com/buildConfiguration/TF_AzureRM_AZURERM_SERVICE_PUBLIC_NETWORK/644621?buildTab=overview

v-yhyeo0202 added 16 commits November 7, 2025 10:08

Remove TestAccApplicationGateway_authCertificate, authCertificate, an…

7f5b8a7

…d authCertificateUpdated

Deprecate authentication_certificate in azurerm_application_gateway

344eed2

Recover authentication_certificate in documentation and add in depr…

3577682

…ecation notes

Merge remote-tracking branch 'upstream/main' into fix-applicationgate…

e37341a

…way-authcert-acctest

Revise documentation

b95070d

Add plan time catch to avoid application of V1 SKU

9a2c57d

azurerm_application_gateway - Undo authentication_certificate pro…

c8bb307

…perty deprecation

azurerm_application_gateway - Add acceptance test for V1 SKU plan t…

ca09443

…ime catch

azurerm_application_gateway - Refine V1 SKU plan time catch

f4d963a

Merge remote-tracking branch 'upstream/main' into fix-applicationgate…

caf0517

…way-authcert-acctest

azurerm_application_gateway - Add declaration of deprecated V1 SKU …

e98f220

…slices

azurerm_application_gateway - Refine V1 SKU plan time catch

f26fd3d

azurerm_application_gateway - Revise documentation to indicate V1 S…

97bf22e

…KU deprecation

azurerm_application_gateway - Revise documentation

0d7b384

azurerm_application_gateway - add link to V1 SKU deprecation docume…

4dfd211

…ntation

azurerm_application_gateway - deprecate `authentication_certificate…

fa4e0d1

…` argument

github-actions Bot added breaking-change documentation service/network size/XL labels Dec 22, 2025

gerrytan self-requested a review December 22, 2025 21:47

gerrytan suggested changes Jan 20, 2026

View reviewed changes

Merge branch 'main' into deprecate-app-gateway-auth-cert

fe4d3f6

github-actions Bot added size/L and removed size/XL labels Jan 21, 2026

v-yhyeo0202 requested a review from gerrytan January 21, 2026 07:15

github-actions Bot added the waiting-response label Jan 21, 2026

azurerm_application_gateway - fix documentation

8ba2e27

github-actions Bot removed the waiting-response label Jan 21, 2026

gerrytan suggested changes Feb 18, 2026

View reviewed changes

github-actions Bot assigned gerrytan Feb 18, 2026

github-actions Bot added the waiting-response label Feb 18, 2026

azurerm_application_gateway - revise according to review comments

7e57b32

github-actions Bot removed the waiting-response label Feb 20, 2026

v-yhyeo0202 requested a review from gerrytan February 23, 2026 00:08

rcskosir added the deprecation label Mar 25, 2026

Merge branch 'main' into deprecate-app-gateway-auth-cert

a1f273f

github-actions Bot added the waiting-response label Apr 8, 2026

Run make fmt; make terrafmt; make document-fix

c990fad

github-actions Bot removed the waiting-response label Apr 8, 2026


		* `authentication_certificate` - (Optional) One or more `authentication_certificate_backend` blocks as defined below.

		-> Note: `backend_http_settings.authentication_certificate` has been deprecated in accordance with the [deprecation of Application Gateway V1](https://aka.ms/V1retirement) and will be removed in v5.0 of the AzureRM Provider.

Conversation

v-yhyeo0202 commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Community Note

Description

PR Checklist

Changes to existing Resource / Data Source

Testing

Change Log

Rollback Plan

Uh oh!

gerrytan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gerrytan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

v-yhyeo0202 commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-yhyeo0202 commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-yhyeo0202 commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

v-yhyeo0202 commented Dec 22, 2025 •

edited

Loading

v-yhyeo0202 commented Feb 20, 2026 •

edited

Loading

v-yhyeo0202 commented Feb 20, 2026 •

edited

Loading

v-yhyeo0202 commented Apr 8, 2026 •

edited

Loading