Azure – Wildcard host headers in Azure App Service

azureazure-app-servicesazure-web-apps

I have a web app hosted on Azure App Service under my domain app.example.com. Customers access their own content using the following paths:

app.example.com/customer1
app.example.com/customer2
etc..

But I also allow customers to use their own domains by telling them to set up a CNAME record with their DNS provider:

app.customer1domain.net -> app.example.com

I'm trying to figure out how to configure Azure to allow this kind of CNAME pointing. Will I have to configure each customer domain in Azure as a valid host name header?

In IIS I was able to pull this off by setting up a wildcard binding with just a simple *.

Best Answer

You can just add multiple hostname in Azure portal for your App.

Go to Azure portal > Your web app > custom domains > Add hostname

Just add multiple Hostname to your Web app. It works for all domain after adding them. The result looks like this:

Related Solutions

Azure – Hosting wildcard domains such as *.thedomain.com on Windows Azure without using redirections

It seems that, while DNS standard does not explicitly permit CNAME wildcard entries, it does not forbid them either. So there are actually DNS servers that offer wildcard CNAME entries. Aparently BIND does, for instance.

Ssl – SNI and wildcard SSL certificates on the same server with IIS

Baris is right! The SSL certificate configured on an IP:PORT binding (example: 100.74.156.187:443) always takes precedence in http.sys! So the solution is as follows:

Do not configure an IP:443 binding for your wildcard-fallback-certificate but configure a *:443 binding (* means "All Unassigned") for it.

If you have configured your wildcard certificate on the Azure Cloud Service SSL endpoint (as i have) you have to change the SSL binding created by the Azure Cloud Service Runtime (IISconfigurator.exe) from IP:PORT to *:PORT. I am calling the following method in OnStart of my web role:

public static void UnbindDefaultSslBindingFromIp()
{
    Trace.TraceInformation(">> IISTenantManager: Unbind default SSL binding from IP");
    using (var serverManager = new Microsoft.Web.Administration.ServerManager())
    {
        try
        {
            var websiteName = string.Format("{0}_Web", Microsoft.WindowsAzure.ServiceRuntime.RoleEnvironment.CurrentRoleInstance.Id);
            var site = serverManager.Sites[websiteName];
            var defaultSslBinding = site.Bindings.Single(b => b.IsIPPortHostBinding && b.Protocol == "https");
            defaultSslBinding.BindingInformation = string.Format("*:{0}:", defaultSslBinding.EndPoint.Port);
            serverManager.CommitChanges();
        }
        catch (Exception ex)
        {
            Trace.TraceError(ex.ToString());
        }
    }
}

The following screenshot shows a working configuration of our cloud service. Please don't be confused about the non-standard ports. The screenshot is from the emulated cloud service.

working IIS configuration

One further thing to mention: Do not change all bindings to * because the HTTP (port 80) binding only works with IP:PORT binding in the deployed cloud service. Something else is bind to IP:80 so *:80 does not work because * stands for "all unassigned" and the IP is already assigned somewhere else in http.sys.

Best Answer

Related Solutions

Azure – Hosting wildcard domains such as *.thedomain.com on Windows Azure without using redirections

Ssl – SNI and wildcard SSL certificates on the same server with IIS

Related Topic