On 14 September 2026, the preview property enableCustomCATrust will retire. After that date, enableCustomCATrust=true node pool level field will no longer enable the Custom Certificate Authority (CA) feature in AKS.
The last preview API that supports this property is 2025-08-02-preview.
Existing node pools that still rely on enableCustomCATrust=true might experience failures during scaling operations or when certificates are updated.
Required Action
To avoid service disruption, update the impacted clusters and node pools and remove the preview property before 14 September 2026.
Update your node pools to remove the Custom CA Trust property:
az aks nodepool update \
--resource-group \
--cluster-name \
--name \
--disable-custom-ca-trust
Update your clusters to remove the Custom CA Trust property:
az aks update \
--resource-group \
--name \
--disable-custom-ca-trust
If you want Custom CA Trust enabled on your clusters after this retirement, use --custom-ca-trust-certificates and provide a path to a certificate file. For more information, see AKS Custom Certificate Authority documentation.
On 14 September 2026, the preview property
enableCustomCATrustwill retire. After that date,enableCustomCATrust=truenode pool level field will no longer enable the Custom Certificate Authority (CA) feature in AKS.The last preview API that supports this property is 2025-08-02-preview.
Existing node pools that still rely on enableCustomCATrust=true might experience failures during scaling operations or when certificates are updated.
Required Action
To avoid service disruption, update the impacted clusters and node pools and remove the preview property before 14 September 2026.
Update your node pools to remove the Custom CA Trust property:
az aks nodepool update \
--resource-group \
--cluster-name \
--name \
--disable-custom-ca-trust
Update your clusters to remove the Custom CA Trust property:
az aks update \
--resource-group \
--name \
--disable-custom-ca-trust
If you want Custom CA Trust enabled on your clusters after this retirement, use --custom-ca-trust-certificates and provide a path to a certificate file. For more information, see AKS Custom Certificate Authority documentation.