From 27db4f97d1e592b11c0ee9b76f74cdb94d61d4d4 Mon Sep 17 00:00:00 2001
From: Elle Tojaroon <15943485+ElleTojaroon@users.noreply.github.com>
Date: Tue, 16 Jun 2026 20:34:59 -0700
Subject: [PATCH 1/2] List site-scoped certificates for Flex Consumption apps
 in az webapp config ssl list

---
 .../azure/cli/command_modules/appservice/custom.py       | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/azure-cli/azure/cli/command_modules/appservice/custom.py b/src/azure-cli/azure/cli/command_modules/appservice/custom.py
index e9eab32caae..897d52b85fe 100644
--- a/src/azure-cli/azure/cli/command_modules/appservice/custom.py
+++ b/src/azure-cli/azure/cli/command_modules/appservice/custom.py
@@ -6846,7 +6846,14 @@ def list_ssl_certs(cmd, resource_group_name, name=None):
     if name:
         raise ArgumentUsageError("--name is only supported for Flex Consumption function apps. "
                                  "For other app types, certificates are managed at the resource group level.")
-    return client.certificates.list_by_resource_group(resource_group_name)
+    # Resource-group-level listing. Classic certificates are managed at the resource group level,
+    # but certificates for Flex Consumption function apps are stored per-site and are not returned
+    # by certificates.list_by_resource_group. Include those so the listing is complete.
+    certs = list(client.certificates.list_by_resource_group(resource_group_name))
+    for app in client.web_apps.list_by_resource_group(resource_group_name):
+        if app.kind and 'functionapp' in app.kind and \n                is_flex_functionapp(cmd.cli_ctx, resource_group_name, app.name):
+            certs.extend(client.site_certificates.list(resource_group_name=resource_group_name, name=app.name))
+    return certs
 
 
 def show_ssl_cert(cmd, resource_group_name, certificate_name, name=None):

From 90da9936110dba39d36ea91936ddf19e6cd06775 Mon Sep 17 00:00:00 2001
From: Elle Tojaroon <15943485+ElleTojaroon@users.noreply.github.com>
Date: Wed, 17 Jun 2026 10:12:14 -0700
Subject: [PATCH 2/2] Fix line continuation and normalize functionapp kind
 check in list_ssl_certs

---
 .../azure/cli/command_modules/appservice/custom.py       | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/azure-cli/azure/cli/command_modules/appservice/custom.py b/src/azure-cli/azure/cli/command_modules/appservice/custom.py
index 897d52b85fe..d3374840336 100644
--- a/src/azure-cli/azure/cli/command_modules/appservice/custom.py
+++ b/src/azure-cli/azure/cli/command_modules/appservice/custom.py
@@ -6846,12 +6846,13 @@ def list_ssl_certs(cmd, resource_group_name, name=None):
     if name:
         raise ArgumentUsageError("--name is only supported for Flex Consumption function apps. "
                                  "For other app types, certificates are managed at the resource group level.")
-    # Resource-group-level listing. Classic certificates are managed at the resource group level,
-    # but certificates for Flex Consumption function apps are stored per-site and are not returned
-    # by certificates.list_by_resource_group. Include those so the listing is complete.
+    # Resource-group-level listing returns classic certificates. Certificates for Flex Consumption
+    # function apps are stored per-site and are not returned by certificates.list_by_resource_group,
+    # so enumerate those as well to give a complete view.
     certs = list(client.certificates.list_by_resource_group(resource_group_name))
     for app in client.web_apps.list_by_resource_group(resource_group_name):
-        if app.kind and 'functionapp' in app.kind and \n                is_flex_functionapp(cmd.cli_ctx, resource_group_name, app.name):
+        if (app.kind and 'functionapp' in app.kind.lower()
+                and is_flex_functionapp(cmd.cli_ctx, resource_group_name, app.name)):
             certs.extend(client.site_certificates.list(resource_group_name=resource_group_name, name=app.name))
     return certs