Share via

What is the official and up-to-date list of root CA certificates that we can trust for Azure services (especially Event Grid)?

Embbeded System Developer 0 Reputation points
2025-10-16T11:51:16.5333333+00:00

We are Azure customers and are integrating embedded (IoT) devices that connect to the Event Grid service. To ensure operational continuity, we need absolute clarity about which root CA certificates are used by Azure for service endpoints (e.g., Event Grid, REST APIs, TLS).

Our questions are:

What is the official, up-to-date list of root CA certificates that we can trust for device connections to Azure services (especially Event Grid)?

Do you have an official channel (email, RSS, update feed, changelog page) to announce changes or additions to this list of certificates (CA rotation, addition of new roots)?

Do you allow or recommend that customers use certificate pinning based on this root ca list https://free.blessedness.top/en-us/azure/security/fundamentals/azure-ca-details?

Thank you in advance for your technical support.

Azure Event Grid
Azure Event Grid
An Azure event routing service designed for high availability, consistent performance, and dynamic scale.
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nathan Roberts (SN) 7,761 Reputation points Volunteer Moderator
    2025-10-18T09:42:06.64+00:00

    Hey there, Embbeded System Developer

    What is the official, up-to-date list of root CA certificates that we can trust for device connections to Azure services (especially Event Grid)?

    I would say the official; up-to-date list would be included in the article you have referenced. These learn articles are constantly updated to reflect changes that have been made.

    Do you have an official channel (email, RSS, update feed, changelog page) to announce changes or additions to this list of certificates (CA rotation, addition of new roots)?

    When you look at the article you have referenced, it does have a section called 'Past changes' that the team who make changes to that section of the article to reflect what changes they have made. You can jump straight to this section by following this link: https://free.blessedness.top/en-us/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list#past-changes

    In other services on Azure, you get a banner that informs you of any major changes. It may be worth keeping an eye on that article and the Azure portal to check if there are any changes that are being implemented.

    Do you allow or recommend that customers use certificate pinning based on this root ca list https://free.blessedness.top/en-us/azure/security/fundamentals/azure-ca-details?

    This depends on the type of application you are developing and how you want it to be accessed. There is an article here about certificate pinning: https://free.blessedness.top/en-us/azure/security/fundamentals/certificate-pinning

    I think really, this would be down to individual developers. Some may agree with certificate pining, others may not. For me, when reading into this, there are built in techniques where the system/browser does this automatically and blocks other certificates that are not the most recent certificate. So, with this been the case, I would have thought certificate pinning by the developer was not needed. However, other folk may have their own thoughts about this, as I am just learning myself.

    Hope this is helpful,
    Nathan

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.