Fixing an Azure Arc Certificate Expiration Issue

Azure Arc uses certificates to establish a secure identity between an on-premises or multicloud server and Azure. If the certificate expires and cannot be renewed automatically, the machine enters a disconnected state and displays the following message in the Azure portal:

The server certificate has expired, and automatic reconnection is not possible.

In some cases, reconnecting the server is not as simple as running the onboarding script again. This article walks through the troubleshooting process and the steps required to restore the connection.

Symptoms

The Azure Arc machine appears as Disconnected in the Azure portal, and attempting to reconnect it does not resolve the issue.

Trying to disconnect the server using the standard command:

azcmagent disconnect

may fail with an error similar to:

			
failed to delete resource in Azure
Delete "https://management.azure.com/..."
wsarecv: An existing connection was forcibly closed by the remote host

Although the error suggests a connectivity problem, it is worth verifying that the server can still reach Azure.

Step 1 – Verify connectivity

Start by confirming that the server can establish an HTTPS connection to Azure Resource Manager.

Test-NetConnection management.azure.com -Port 443

If the result is:

TcpTestSucceeded : True

basic network connectivity is working. At this point, the issue is likely related to the Azure Arc registration rather than firewall rules or internet access.

It is also a good idea to review the current Azure Arc agent status.

azcmagent show

This command provides information about the agent version, connection status, and any reported errors.

Step 2 – Remove the local Azure Arc registration

When the server certificate has already expired, the agent may no longer be able to complete a standard disconnect operation because it cannot properly communicate with Azure.

Instead, remove only the local registration:

azcmagent disconnect --force-local-only

This command removes the local Azure Arc configuration without attempting to delete the Azure resource.

Step 3 – Delete the Azure Arc resource

After the local registration has been removed, delete the corresponding Azure Arc machine from the Azure portal.

Removing the stale resource ensures that the next onboarding process creates a completely new registration instead of trying to reuse an existing one.

Step 4 – Run the onboarding script

Finally, run the Azure Arc onboarding script generated from the Azure portal.

The onboarding process creates:

a new Azure Arc identity,
a new certificate,
a fresh registration in Azure.

Once the script completes successfully, verify the connection by running:

azcmagent show

The machine should now report a Connected status in both the command output and the Azure portal.

Why does this happen?

Azure Arc relies on certificates to authenticate managed machines with Azure. Under normal circumstances, these certificates are renewed automatically by the Azure Connected Machine Agent.

If the certificate expires before it can be renewed—for example, because the machine has been disconnected for an extended period or the renewal process fails—the agent can no longer authenticate itself with Azure. As a result, automatic recovery is no longer possible.

Removing the local registration and onboarding the server again generates a new identity and certificate, allowing the machine to establish a trusted connection with Azure once more.

Summary

If you encounter the error:

The server certificate has expired, and automatic reconnection is not possible

the following recovery process is often the quickest solution:

Verify connectivity to Azure.
Review the Azure Arc agent status with azcmagent show.
Disconnect the machine locally using:azcmagent disconnect --force-local-only
Delete the existing Azure Arc machine resource.
Run the Azure Arc onboarding script again.

This approach restores the Azure Arc registration without reinstalling the Azure Connected Machine Agent and creates a new certificate and machine identity.

Hopefully this saves you some troubleshooting time the next time an Azure Arc machine refuses to reconnect.

Discovering Azure