Trying to see if this is even possible. I have Azure Virtual Machine running as a windows webserver IIS. Is it possible to setup Azure CDN to pull content from that webserver? Things tried. Created CDN. Changed Origin to custom and set the public IP address of the webserver. But just get "Our services aren't available right now message" when accessing with the cdn hostname. Webserver works fine if I go to by the public ip address.

@Mike Myers , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. Greetings. You should be able to use a public IP behind Azure CDN as long as the backend is healthy. The error message you shared usually appears with new deployments. Can you please confirm if the issue still persists? Cheers, Kapil

Can you setup Azure CDN custom origin to be public IP address of windows azure virtual machine running IIS

Accepted answer

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-05-23T06:01:27.11+00:00

@Mike Myers ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Greetings.

You should be able to use a public IP behind Azure CDN as long as the backend is healthy.

The error message you shared usually appears with new deployments.

Can you please confirm if the issue still persists?

Cheers,

Kapil
Please sign in to rate this answer.
Mike Myers 20 Reputation points

2024-05-23T14:25:50.5+00:00

Yes this issue still persists. Trying to figure out if there are any additional configurations needed if this design can work this way. So are you telling me that this can work from a current azure webserver IIS? I am finding it hard to find documentation. All documentation keeps leading me to using a storage account.

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-05-23T15:21:33.2966667+00:00

@Mike Myers ,

Please recheck your configuration.

I just did a lab and I was able to get this working

Make sure you're backend supports HTTPS

If not, please configure the origin to only use HTTP

This option is available under Origin ----> Configure origin

And make sure you are accessing the CDN EndPoint using HTTP and not HTTPS

I doubt you currently have HTTPS set up as you are using the Public IP - so for testing, you can disable HTTPS and try accessing the endpoint via HTTP (Port 80) and let us know how it goes.

Cheers,

Kapil

Mike Myers 20 Reputation points

2024-05-23T15:31:16.2233333+00:00

@KapilAnanth-MSFT I think that might be part of the issue. I took out https allowed on the origin and was able to access using the hostname now. Thank you for the tip. I'll continue testing and hope thats all was needed.

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-05-23T16:36:00.9366667+00:00

@Mike Myers ,

You are most welcome. Glad we could be of assistance.

I have summarized our discussion and converted it to a new answer.

I would highly appreciate if you could Accept the answer and close this thread.

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil

Mike Myers 20 Reputation points

2024-05-23T17:36:40.4466667+00:00

So http looks to work. I am looking into how to get it to work with https. Does the CDN provide the certificate for its hostname. I am just guessing that i would need it to put that on my webserver or vise versa. Does that sound about right?

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-05-24T07:01:17.6066667+00:00

@Mike Myers ,

From my analysis, Azure CDN does not offer TLS Offloading.

This means, if the original request comes in via HTTPS - the backend request would also be in HTTPS.

Same is the case with HTTP

With that said,

Azure CDN would use the certificate "*.azureedge.net" to accept HTTPS connections.

You cannot use this certificate in your backend server, which has no knowledge of the hostname "*.azureedge.net"

SNI would fail.

You have to work with your webserver team to configure TLS at the backend.

While it is possible to get a certificate for IP, this is discouraged and is a not recommended practise.

So, you have to purchase a domain, and get a TLS Certificate issued to your server from a valid certificate authority (CA).

Once you configure TLS on your backend, you should be able to use HTTPS with Azure CDN.

P.S : You can also consider AFD if you require TLS Offloading.

You can use the "Forwarding protocol" field to specify HTTP only, HTTPS only, or match incoming request.

Hope

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Mike Myers 20 Reputation points

2024-06-14T12:12:42.6333333+00:00

Not sure if I am able to continue this Thread but I am trying to find any articles to get https to work with the cnd still. The webserver is just doing self signed and I am able to access externally by https://ipaddress with no issues. So not sure if the webserver needs more configuration or if there are other CDN options to allow perhaps.

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-06-14T16:26:12.5+00:00

@Mike Myers ,

I take it that your IIS Server uses a self-signed certificate and accepts connections on https://<ipaddress>.

In that case,

What's the error you are seeing now?

Or the HTTP code you are getting from CDN

Check the diagnostic logs and can you share me what do you see in backendhostname and httpstatuscode?

Cheers,

Kapil

Mike Myers 20 Reputation points

2024-06-14T18:59:07.3966667+00:00

@KapilAnanth-MSFT

Yes the iis server https://<ipaddress> uses self-signed so you get your normal message your connection is not private>advance>Proceed unsafe site etc....

When still try the azure host name> still presents the:

http:// endpoint name works totally fine.

I did not setup the diagnostic logs. I am going through on how to do that now. I enabled the Azure CDN access Logs is that log the backendhostname and httpstatuscode?

Mike Myers 20 Reputation points

2024-06-14T20:23:52.5366667+00:00

So backend host name gives the public ipaddress:443 and httpstatuscode of 502

Mike Myers 20 Reputation points

2024-06-14T20:24:55.6+00:00

Ok log just says 502 httpstatuscode the backendhostname is the publicIpaddress:443

KapilAnanth-MSFT 47,046 Reputation points Microsoft Employee

2024-06-17T12:14:30.2333333+00:00

@Mike Myers ,

Can you also share what you see for "httpStatusDetails_s"?

Technically, "HttpStatusCode" is from CDN and "HttpStatusDetails" is from backend

It is possible that CDN is simply sharing the HTTP Response the backend gave to begin with

See : CDN Raw logs properties

From my lab, see :

Cheers,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Can you setup Azure CDN custom origin to be public IP address of windows azure virtual machine running IIS

0 additional answers

Your answer