Share via

Azure Application Gateway Wildcard

Pascal Dittmer 1 Reputation point
2020-07-22T12:08:23.167+00:00

I want to configure an Application Gateway with multiple sites. 

x1.contoso.com
x2.contoso.com
x3.contoso.com
...

I have a wildcard certificate for *.contoso.com

I only get a single subdomain to work when I set the custom hostname in the HTTP-Settings for example to x1.contoso.com. The Listener is configured for multisite and the hostnames with *.contoso.com. They all point to the same VM (CentOS, Apache)
The backend health check says that the CN of the backend cert does not match the host header in the health probe. But even if I put *.contoso.com as custom hostname in the HTTPS-Settings, or create a custom probe, no change. I read that my wildcard could need SANs, but that would make no sense, because I would need a new cert erverytime I want to add a new subdomain right? How can I get this to work?

Maybe you can help me.
Pascal

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,217 questions

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gregor Suttie 11 Reputation points MVP
    2020-11-30T08:35:18.427+00:00

    Do we know when this will GA?

    2 people found this answer helpful.
    0 comments
  2. Jim M 146 Reputation points
    2021-05-18T08:58:44.51+00:00

    I have a similar issue. I just have a single backed server in a pool - host.here.com. That server is installed with a wildcard cert which has the CN here.com. I have configured app gateway for multi site and i have tried overriding the hostname with 'host.here.com' in the http setting. But it still complains that the CN in the certificate does not match my host name.

    It would be nice if app gateway had a setting to make it accept any backend server cert, regardless of mismatch.

    1 person found this answer helpful.
  3. Jim M 146 Reputation points
    2021-05-27T02:45:37.323+00:00

    I found the issue. Whilst the backend server was presenting the required cert, it was not presenting the full cert chain. Therefore AGW is unhappy with the cert. Once the backend server config was corrected, all came good.

    1 person found this answer helpful.
  4. GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
    2020-07-29T09:57:15.78+00:00

    Hello @Diddy512-6008 ,

    Wildcard host names in listeners for Application Gateway v2 is currently in public preview! You can configure host names with wildcard characters (* and ?) and up to 5 host names per listener with comma separated values.

    Using a wildcard character in the host name, you can match multiple host names in a single listener. For example, *.contoso.com can match with ecom.contoso.com, b2b.contoso.com as well as customer1.b2b.contoso.com and so on.

    Please refer : https://learn.microsoft.com/en-us/azure/application-gateway/multiple-site-overview#wildcard-host-names-in-listener-preview

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.

  5. KoenTee 6 Reputation points
    2021-07-01T12:26:24.217+00:00

    @Jim M

    I'm equally interested to learn what you did on your backend server config.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.