Getting single Azure WebRole to support multiple domains on seperate SSL certificates

Question

I have an Azure Cloud project containing a cache role, a worker role, and a web role. I have a new requirement to have the Web Role service two separate domains each with a different SSL Certificate. They also need to be bound to the same port. I don't have a multi-domain cert since they are owned by different people.

To do this I think I need to run separate role instances of the web role so I don't have conflicts with the port/cert bindings. Beyond the domain name and the SSL cert the project is the same. Can anyone tell me an efficient way to accomplish this?

In the short term I would be willing to run on separate ports but have not been able to get that to work either.

Answer 1

As you said a single WebRole only has one external IP and therefor I think by using in the service definition (.csdef) file you can only have one certificate for a https endpoint on port 443. If you had a cert with multiple SANs it probably would be possible to serve different sites on the same port.

This blog post describes what you are looking for (setting up the SNI SSL extenison supported by IIS 8.0): http://www.vic.ms/microsoft/windows-azure/multiples-ssl-certificates-on-windows-azure-cloud-services/

The configuration options for multiple web sites in one Web Role are described in the MSDN article: Configure a Web Role for Multiple Web Sites

As the short term solution you could try to use additional end-points:

<InputEndpoint name="HttpsIn2" protocol="https" port="444" certificate="foo.com" />
<InputEndpoint name="HttpsIn3" protocol="https" port="445" certificate="bar.com" />

and use them in additional sites:

<WebRole name="Web" vmsize="Small">
<Sites>
  <Site name="Web"> ... </Site>
  <Site name="foo" physicalDirectory="..\..\..\Web\Content">
    <Bindings>
      <Binding hostHeader="www.foo.com" name="HttpsBindingA" endpointName="HttpsIn2" />
    </Bindings>
  </Site>
  <Site name="bar" physicalDirectory="..\..\..\Web\Content">
    <Bindings>
      <Binding hostHeader="www.bar.com" name="HttpsBindingB" endpointName="HttpsIn3" />
    </Bindings>
  </Site>