You manage TLS certificates for an Azure App Service. Certificates must be issued by DigiCert, auto-renew 30 days before expiration, and alert your operations team when renewal occurs. You will store and manage the certificates in Azure Key Vault. Which actions should you take? Select all that apply.

To meet the requirement of DigiCert issuance, you must configure a certificate issuer in Key Vault specifically for DigiCert and then associate your certificate with this issuer. For auto-renewal 30 days before expiration, a Key Vault certificate policy is essential; within this policy, you define a lifetime action to trigger renewal at the specified interval. To alert the operations team upon renewal, adding certificate contacts in Key Vault ensures that email notifications are sent for renewal events and expirations. The App Service Managed Certificate option is incorrect because it issues certificates from App Service's own CA and does not allow specifying DigiCert as the issuer or integrating with existing Key Vault certificates for auto-rotation.