Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have some content hosted for our Azure application on the Azure CDN - we can access this nicely over https using the standard endpoint address, however for 'neatness' our customer would like to use a custom domain with https - so we can access our assets from https://cdn.app.com. Is this possible with the Azure CDN?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

It's currently not possible to use the Azure CDN to deliver content over SSL with a custom domain name.

It would involve giving Azure access to your private key for them to propagate it to all of their sites, so I can't see them offering it anytime soon.

The closest you could get to this is if you used a traffic manager endpoint and served these from your own Azure instances. This would be more costly than running off the CDN though, and won't offer as many sites to benefit from.

share|improve this answer
    
+1 - "It would involve giving Azure access to your private key" - First time I've actually heard an explanation given for why this might be problematic, and it seems like a somewhat valid security concern (although if we are already willing to trust them with it for the Azure Compute endpoints, I don't see why they shouldn't be able to mitigate this risk for the CDNs as well) –  Steve Feb 28 '13 at 9:17
1  
It's not so much the problem of them having access to your private key, it's the number of IP addresses that would be required (as the way that SSL works for compatibility is the server presents the certificate before knowing what the URL is). –  Matthew Steeples Mar 2 '13 at 11:35
    
Thanks. Could you explain a bit further? Other CDNs offer SSL support on custom domains - so even without digging down into the technical details I feel like whatever the issue is, it must be able to be handled (as other people already are). My 5 second google search gave me at least one example; gogrid supports SSL for custom domains. Can't Microsoft accomplish whatever GoGrid (which is based on EdgeCast AFAIK) can? –  Steve Mar 2 '13 at 18:27
2  
They can accomplish it in the same way, but it'd be the same reason that the feature from GoGrid costs $300. Basically they'd need to run your CDN endpoint on a different IP address to the rest of the services so that the correct certificate could be served up. I believe that the technical reasons are being addressed but won't be available for some years to give all platforms chance to adopt it. –  Matthew Steeples Mar 3 '13 at 0:57
    
Thanks for the extra information! I'm now remembering a bit more about how SSL connections work - and that the HTTP Host header is the only way the server would know which domain name the client was attempting to access (short of an exclusive IP) and, in fact, is part of what is encrypted. Makes total sense now. Thanks again! –  Steve Mar 3 '13 at 2:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.