Public Preview: TLS/SSL certificate support for Azure Functions Flex Consumption

Flex Consumption introduces a site-scoped certificate model in public preview in all the regions where Flex Consumption is available. Unlike webspace-scoped certificates on other hosting plans which are shared across apps in the same region + resource group, Flex certificates are scoped to an individual function app.

Each function app can hold up to 3 private (.pfx) and 3 public (.cer) certificates uploaded directly, imported from Azure Key Vault, or issued as free App Service Managed Certificates to enable custom domains, client-certificate authentication, and mutual TLS scenarios on Flex Consumption.

To access certificates from code Flex Consumption uses a per-certificate "Accessible to app code" toggle in the portal instead of the WEBSITE_LOAD_CERTIFICATES app setting used on other plans. Because Flex Consumption runs on Linux, code reads certificates from file paths (/var/ssl/certs for public, /var/ssl/private for private) rather than from a Windows certificate store.

Currently, the Azure portal is the recommended path for configuring certificates during preview. Apps migrating from another plan should add their certificates to the new Flex Consumption app rather than carrying webspace-scoped certificates across.

Learn more:

• Configure site-scoped certificates
• Infrastructure as code instructions
• Cross-plan certificate comparison