This enables us to execute PS commands remotely on Azure IAAS VM from our local machine.

This option is available when you create a virtual machine using the "From Gallery" option on the management portal as shown below :

The last step of the wizard displays the option of PowerShell as shown below :

A default firewall endpoint will be created for the deployment.

This enables you to have the VM immediately configured and ready to use without ever having to RDP into the instance.

Start a new Powershell console on your local machine and use the Enter-PSSession command as shown below :

Enter-PSSession –ComputerName <server name>.cloudapp.net -UseSSL -Credential(Get-Credential)

You will get the below error when you try to connect to the IAAS VM remotely via PS :

This is because Remote PS uses HTTPS and the certificate used for your Virtual Machine is a self signed certificate.

To solve this open your browser and navigate to your VM and the public endpoint for Remote PS.

Eg : https://servicename.cloudapp.net:5986

We don't find the certificate button on IE, hence used chrome. Install the certificate under “Current User” and then “Trusted root authority”.

Go to Details tab -> Copy to file -> save the file on your machine.

Double click the file -> Install it under "Current User" -> "Trusted Root Certification Authorities"

After, you will be able to connect to the Azure VM via PS as shown below :

==============================================================================================================

Azure VM is up and running, but RDP fails - Try the below work around which uses remote powershell as explained.

> uvnc is a 3rd party tool : Download and save the exe file on your machine using the below link : 

> https://www.uvnc.com/component/jdownloads/finish/4-setup/65-setup-x64-119x/0.html

> Create a txt file with the below content and name it as setup.txt -

   [Setup]
   Lang=en
   Dir=C:\Program Files\uvnc bvba\UltraVNC
   Group=UltraVNC
   NoIcons=0
   SetupType=custom
   Components=ultravnc_server_s
   Tasks=installservice,startservice

> Please find the configuration file "UltraVNC.ini" file attached.

> Upload the 3 files to your storage account and mark the container as public.

> Add 2 endpoint for ports 5800 and 5900 for the VM on the portal.

Execute the below PS commands in sequence -

    $source = "https://<Your storage account name>.blob.core.windows.net/<Container name>/UltraVNC_1_1_9_X64_Setup.exe"

    $dest = "C:\Users\<User name>\ultravnc.exe"

    $wc = New-Object System.Net.WebClient

    $wc.DownloadFile($source,$dest)

    $source2 = "https://<Your storage account name>.blob.core.windows.net/<Container name>/setup.txt"

    $dest2 = "C:\Users\<User name>\setup.txt"

    $wc = New-Object System.Net.WebClient

    $wc.DownloadFile($source2,$dest2)

    cd..

    .\UltraVNC.exe /silent/loadinf="setup.txt"

    $source1 = "https://<Your storage account name>..blob.core.windows.net/<Container name>/UltraVNC.ini"

    $dest1 = "C:\Program Files\uvnc bvba\UltraVNC\UltraVNC.ini"

    $wc = New-Object System.Net.WebClient

    $wc.DownloadFile($source1,$dest1)

    netsh advfirewall firewall add rule name='VNC5800' dir=in protocol=TCP localport=5800 action=allow profile=any

    netsh advfirewall firewall add rule name='VNC5900' dir=in protocol=TCP localport=5900 action=allow profile=any

    net stop uvnc_service

    net start uvnc_service

Install “UltraVNC Viewer” on your local machine.

Open the viewer tool and provide the VIP address in the text box.

Type the password as “azurevnc”. You will be connected to the VM.

Click on the left hand top button “Ctrl + Alt + Del” and type the RDP password.

Sample PS screenshot -

NOTE : This will work only if the VM is up and running, but RDP fails.

Telnet to 5986 must be successful – This will allow us to install the uvnc server tool on the VM using PS remoting.

There are some known issues with uvnc tool : https://www.uvnc.com/.

There is no license required to use this tool.

UltraVNC.ini

You can implement this by using ServerManager class defined in Microsoft.Web.Administration DLL.

 1. Add Microsoft.Web.Administration DLL to the project reference. (Path of Microsoft.Web.Administration DLL: C:\Windows\System32\inetsrv).

2. Set Copy local property of the above DLL to true. (Right click on the DLL -> properties -> copy local = true)

3. Copy and paste the below code snippet.

4. Run the WebRole in elevated execution context. (Add the below tag in servicedefinition.csdef file to run the code in elevated privileges).

   <Runtime executionContext="elevated"/>

// The below code snippet must be added in WebRole.cs file.

using Microsoft.WindowsAzure;

using Microsoft.WindowsAzure.Diagnostics;

using Microsoft.WindowsAzure.ServiceRuntime;

using Microsoft.WindowsAzure.Diagnostics.Management;

using Microsoft.Web.Administration;

namespace WebRole1

{

   publicclassWebRole : RoleEntryPoint

   {

       publicoverridebool OnStart()

       {

           //============================= Configure diagnostic logging ================================//

      // Obtain a reference to the initial default configuration.

      string wadConnectionString = "Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString";

          CloudStorageAccount storageAccount = CloudStorageAccount.Parse(RoleEnvironment.GetConfigurationSettingValue(wadConnectionString));

           RoleInstanceDiagnosticManager roleInstanceDiagnosticManager = storageAccount.CreateRoleInstanceDiagnosticManager

                                (RoleEnvironment.DeploymentId,RoleEnvironment.CurrentRoleInstance.Role.Name, RoleEnvironment.CurrentRoleInstance.Id);

           DiagnosticMonitorConfiguration config = DiagnosticMonitor.GetDefaultInitialConfiguration();

           config.ConfigurationChangePollInterval = TimeSpan.FromSeconds(30.0);

           //transfer the IIS and IIS Failed Request Logs

           config.Directories.ScheduledTransferPeriod = TimeSpan.FromMinutes(1.0);

           //set the configuration for use

           roleInstanceDiagnosticManager.SetCurrentConfiguration(config);

      //===========================================================================================//

      //============================== Custom diagnostic logging =================================//

      using (ServerManager serverManager = newServerManager())

          {

               string str = RoleEnvironment.Roles.Values.ToString();

               // Note that "_Web" is the name of the site in the ServiceDefinition.csdef,

         // so make sure you change this code if you change the site name in the .csdef    

         Site site2 = serverManager.Sites[RoleEnvironment.CurrentRoleInstance.Id + "_Web"];

               site2.LogFile.LogExtFileFlags = LogExtFileFlags.Date | LogExtFileFlags.Time | LogExtFileFlags.ClientIP | LogExtFileFlags.Host | LogExtFileFlags.BytesSent | LogExtFileFlags.BytesRecv;

               site2.LogFile.Period = LoggingRolloverPeriod.Hourly;

               serverManager.CommitChanges();

          }

      //===========================================================================================//

      returnbase.OnStart();

        }

    }

}

You will see the below settings in IIS on the Azure VM.

You can check the IIS logs (in custom format) in the below path on the VM :

C:\Resources\Directory\<DeploymentID>.WebRole1.DiagnosticStore\LogFiles\Web\W3SVC1273337584

 If you are running the application on your local machine, make sure the application is deployed on IIS web server instead of IIS Express (applicable for SDK 1.7).

You can find this setting, when you right click on your cloud project -> properties.

Hope this helps :)

Default values in IIS 7.0

> Maximum allowed content length (Bytes): 30000000

> Maximum URL lenght (Bytes): 4096

> Maximum query string (Bytes): 2048

The above values can be
modified using one of the below techniques for an Azure application:  

• Using a Startup task
• Using webrole Onstart method
• Using Web.config

Using a Startup Task:

====================================================================================================================

Create a batch file : ConfigureReqFiltering.cmd

Set copy to output directory = copy always for this file. (Right click -> Properties)

%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/security/requestFiltering/requestLimits.maxQueryString:"204800" /commit:apphost

%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/security/requestFiltering/requestLimits.maxAllowedContentLength:"204800" /commit:apphost

%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/security/requestFiltering/requestLimits.maxUrl:"204800" /commit:apphost

 exit / b 0

====================================================================================================================

Using WebRole Onstart method:
====================================================================================================================

Add Microsoft.Web.Administration DLL to the project reference. (Path of Microsoft.Web.Administration DLL: C:\Windows\System32\inetsrv).    

Set Copy local property of the above DLL to true. (Right click on the DLL -> properties -> copy local = true)

Copy and paste the below code snippet.

public override bool OnStart()

{

        public override bool OnStart()

        {

            ServerManager iisManager = new ServerManager();

            Application app = iisManager.Sites[RoleEnvironment.CurrentRoleInstance.Id + "_Web"].Applications[0];

            Configuration config = iisManager.Sites[RoleEnvironment.CurrentRoleInstance.Id + "_Web"].GetWebConfiguration();

            ConfigurationSection requestFilteringSection = config.GetSection("system.webServer/security/requestFiltering");

            ConfigurationElement requestLimitsElement = requestFilteringSection.GetChildElement("requestLimits");

            //Set the required attribute for Query String

            requestLimitsElement.SetAttributeValue("maxQueryString", 204800);

            //Set the required attribute for Content lenght

            requestLimitsElement.SetAttributeValue("maxAllowedContentLength", 204800);

            //Set the required attribute for Max URL

            requestLimitsElement.SetAttributeValue("maxUrl", 204800);

            //Commit the changes done to server manager.

            iisManager.CommitChanges();

            return base.OnStart();

         }

    }

Run the WebRole in elevated execution context. (Add the below tag in servicedefinition.csdef file to run the code in elevated privileges)

<Runtime executionContext="elevated"/>

====================================================================================================================

Using Web.config:
====================================================================================================================

<system.webServer>

    <modules runAllManagedModulesForAllRequests="true" />

  <!-- Web.config setting -->

    <security>

          <requestFiltering>

                   <requestLimits maxQueryString="1048000" maxAllowedContentLength="1048000" maxUrl="1048000"/>

          </requestFiltering>

    </security>

</system.webServer>

====================================================================================================================

If you are unable to see the interface for request filtering, you can install Microsoft Administration Pack for IIS 7.0 on the VM, which includes a user interface for request filtering.

https://www.iis.net/expand/AdministrationPack

> Make the appropriate changes in the registry, and then export the appropriate subkey or subkeys. Exported registry subkeys are automatically saved as .reg files.

1. Click Start, click Run, type regedit
   in the Open box, and then click OK.
2. Locate and then click the subkey that holds
   the registry item or items that you want to change.
3. Click File, and then click Export.
   This step backs up the subkey before you make any changes. You can import this
   file back into the registry later if your changes cause a problem.
4. In the File name box, type a file name
   to use to save the .reg file with the original registry items, and then click Save.

            Example :

> Add the exported .reg file (ChangeVersion.reg in this example) to your application and set “Copy to output Directory = Copy always”.

> Create a batch file (ChangeRegistrySetting.cmd in this example) and add to your application.

      Right click on the file -> Properties -> set “Copy to output Directory = Copy always”.

      ChangeRegistrySetting.cmd

      =======================

      @echo off

      regedit.exe /s ChangeVersion.reg

      exit /b 0

> Specify the .cmd file to be executed as a startup task on Azure VM.

      Make the necessary changes in ServiceDefinition.csdef file.

> Deploy the application package, RDP to the VM and test.

https://msdn.microsoft.com/en-us/library/windowsazure/ee460782.aspx

Above link contains a sample code which opens the local certificate storenamed “My” and finds the certificate that matches the thumbprint value. Then, it attaches the matching certificate to the request by adding it to the ClientCertificates collection of our HttpWebRequest object.

           // This certificate would have been previously added as a management cert within the Windows Azure management portal.

        string thumbPrint = "your_certificate_thumbprint";

           // Open the certificate store for the current user.

        X509Store certStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);

                certStore.Open(OpenFlags.ReadOnly);

     // Find the certificate with the specified thumbprint.

                certCollection = certStore.Certificates.Find(X509FindType.FindByThumbprint, thumbPrint, false);

     // Close the certificate store.

                certStore.Close();

     // Check to see if a matching certificate was found.

        if (0 == certCollection.Count) {   

                      throw new Exception("No certificate found containing thumbprint " + thumbPrint);

                }

Although certificate exists and you have provided the correct thumbprint, sometimes the code breaks and will not be able to find the certificate on your machine.  

There is no visible difference in the thumbprints or the code base, but the Find method fails to locate the certificate (in the former code snippet).

This issue is due to a special character (“?”) in the thumbprint which gets appended when you copy the thumbprint from the certificate (as shown below).

     "?9401b008b0fd45158fbf70696fe7e0862ac12e67";

It will not be visible, unless you use some hex editor to check the thumbprint.

You can download notepad++ from https://notepad-plus-plus.org/download/v6.0.html.

Verify the thumbprint that is used in your code using notepad++ tool and remove the special character (if it exists).

Alternatively, use the below function which removes the special character from the thumbprint.

       public static string RemoveSpecialCharacter(string inputstr)

       {

           StringBuilder stringbuilder = new StringBuilder();

           for (int count = 0; count < inputstr.Length; count++)

           {

               if ((inputstr[count] >= '0' && inputstr[count] <= '9') || (inputstr[count] >= 'A' && inputstr[count] <= 'z'))

                stringbuilder.Append(inputstr[count]);

           }

           return stringbuilder.ToString();

        }

// Call the function to remove special character.

thumbPrint = RemoveSpecialCharacter(thumbPrint);

=============================================================================================================

Unable to find assembly 'Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'

=================================================================================================================

Cause: The Windows Identity Foundation assemblies are not properly installed to the Windows Azure virtual machine.

Resolution: Use a startup task to reinstall the Windows Identity Foundation package on the virtual machine.

1.  Download the WIF.msu file from this link : https://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17331 

     Windows6.1-KB974405-x64.msu (Windows Server 2008 R2) for osFamily="2"

     Windows6.0-KB974405-x64.msu (Windows Server 2008) for osFamily="1"

2.  osFamily property can be set in serviceconfiguration file.

     osFamily="2" - Specifies the OS family that is substantially compatible with Windows Server 2008 R2.

     osFamily="1" - Specifies the OS family that is substantially compatible with Windows Server 2008 SP2.

     Please refer this link: https://msdn.microsoft.com/en-us/library/windowsazure/ee758710.aspx

3.  Add the WIF.msu to your project and set “Copy to Output Directory Always” to “Copy Always”.

     Run a MSU update package using the following startup task.

     Note : Use Windows6.1-KB974405-x64.msu package if you specify osFamily="2"

               Use Windows6.0-KB974405-x64.msu package if you specify osFamily="1"

     (RegisterDLL.cmd and set copy local = true)

                   @echo off

                   sc config wuauserv start= demand

                   wusa.exe "Windows6.1-KB974405-x64.msu" /quiet /norestart

                   sc config wuauserv start= disabled

                   exit /b 0

4.  Add the below script in the serviceDefinition file.

     <Startup>

           <Task commandLine="RegisterDLL.cmd" executionContext="elevated" taskType="simple" />

     </Startup>

Deploy the package on windows Azure platform.

Do a remote desktop to the VM and you will notice that "Microsoft.IdentityModel" assembly is available in GAC.

Refer the below link :

https://msdn.microsoft.com/en-us/library/windowsazure/hh403974.aspx

=================================================================================================================

Visual studio throws error "The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state. See output window for more information."

Following is the text from my output window:

Windows Azure Tools: Warning: Remapping public port 80 to 81 to avoid conflict during emulation.
Windows Azure Tools: Warning: Remapping private port 80 to 82 in role 'WebRole1' to avoid conflict during emulation.
Windows Azure Tools: The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state.
Server stack trace:
   at System.ServiceModel.Channels.CommunicationObject.Close(TimeSpan timeout)
   at System.ServiceModel.Channels.ServiceChannel.System.IDisposable.Dispose()

Exception rethrown at [0]:
   at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
   at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
   at System.IDisposable.Dispose()
   at Microsoft.ServiceHosting.Tools.DevelopmentFabric.FabricClient.AddServiceDeployment(String tenantName, ServiceModelDefinition serviceModelDefinition, String instanceDescriptionPath, ServiceDeploymentOptions options) 

You may encounter a This communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state error when you start your role in the local development environment, which uses the compute emulator.

The error does not occur when deploying the package to Windows Azure in the cloud.

=================================================================================================================================================================================

Possible Causes and Resolution:

=================================================================================================================================================================================

Cause 1: The Web.config file is marked read-only in compute emulator.

Resolution: Clear the read-only attribute from the web.config file. If you are using a source control system, you may need to check-out the file.

Cause 2: Multiple role instances are writing to same configuration file in compute emulator.

Resolution: Limit the instance count to one for any given role when using the compute emulator. Before deploying to Windows Azure, reset the instance count to a higher value as desired.

Cause 3: The project has a very large number of files.

Resolution: Limit the number of files included in the project.

Cause 4: Errors in the Web.config file.

Resolution: Correct the errors in the Web.config file.

The above mentioned details are documented in this link: https://msdn.microsoft.com/en-us/library/gg494981.aspx

If none of the above options helped you, check if any of the files present in "%LocalAppData%\dftmp\IISConfigurator1.6.0.0" folder (on your development machine) are marked as "read only".

Remove the "read only" property for the files present in the below path (on your development machine). This will fix the issue and enable you to run the application in debug mode.

("%LocalAppData%\dftmp\IISConfigurator1.6.0.0" folder)

Note: IISConfigurator folder name may change based on Windows Azure SDK version you are working on.  

Interestingly, installing Windows Azure connect endpoint on your machine will fix this issue because it resets these file attributes.

=================================================================================================================================================================================

Idle Time-out property can be changed in IIS after you RDP into the VM's of Azure, but this is not recommended and remote desktop must be used only for basic troubleshooting. Any changes done on the Virtual Machine manually after RDP will not be persisted.This is because, in the event of any hardware failure or automatic OS upgrade in Azure cloud, Fabric controller will bring down the VM instance and automatically deploy your package on another VM/on the same VM (Virtual machine). If this happens all the changes done manually on the VM will be lost. Therefore the recommended approach is to perform all the operation by code and deploy the package.

You can implement this by using ServerManager class defined in Microsoft.Web.Administration DLL.

===============================================================================================================

1.  Add Microsoft.Web.Administration DLL to the project reference. (Path of Microsoft.Web.Administration DLL: C:\Windows\System32\inetsrv).

       2.    Set Copy local property of the above DLL to true. (Right click on the DLL -> properties -> copy local = true)

      3.    Copy and paste the below code snippet.

      4.    Run the WebRole in elevated execution context. (Add the below tag in servicedefinition.csdef file to run the code in elevated privileges)

             <Runtime executionContext="elevated"/>

// The below code snippet must be added in WebRole.cs file.

using System;

using System.Collections.Generic;

using System.Linq;

using Microsoft.WindowsAzure;

using Microsoft.WindowsAzure.Diagnostics;

using Microsoft.WindowsAzure.ServiceRuntime;

using Microsoft.Web.Administration;

using Microsoft.WindowsAzure.Diagnostics.Management;

namespace WebRole1

{

   public class WebRole : RoleEntryPoint

  {

        public override bool OnStart()

        {

               ServerManager iisManager = new ServerManager();

               Application app = iisManager.Sites[RoleEnvironment.CurrentRoleInstance.Id + "_Web"].Applications[0];

               //================ idletimeout ====================================================//               

         string dt = iisManager.ApplicationPoolDefaults.ProcessModel.IdleTimeout.ToString();

               TimeSpan ts = new TimeSpan(0, 60, 00);

               iisManager.ApplicationPoolDefaults.ProcessModel.IdleTimeout = ts;

         //================ Enable or disable static/Dynamic compression ===================//

         Configuration config = iisManager.Sites[RoleEnvironment.CurrentRoleInstance.Id + "_Web"].GetWebConfiguration();

               ConfigurationSection urlCompressionSection = config.GetSection("system.webServer/urlCompression");

               urlCompressionSection["doStaticCompression"] = true;

               urlCompressionSection["doDynamicCompression"] = true;

        //================ To change Application pool name ================================//

              app.ApplicationPoolName = "ASP.NET v4.0 Classic";

        // Commit the changes done to server manager.

               iisManager.CommitChanges();

               return base.OnStart();

        }

    }

}

===============================================================================================================

This can also be done using a startup task in windows azure, please refer the below blog:

https://blog.smarx.com/posts/controlling-application-pool-idle-timeouts-in-windows-azure

       Q. How do I access my cloudapp.net application using my own custom domain name?

       Q. How do I access my application using custom root domain as well as sub domain?

       Q. How do I access my cloud application hosted on Azure, without www in my domain URL?  

       Q. Can we create specific subdomain, something like <prefix>.<myapp>.cloudapp.net instead of <prefix>.cloudapp.net.

       Q. We need to access our cloudapp.net application over HTTPS, but cannot buy an SSL certificate issued for a cloudapp.net domain. What is the solution?

       Q. Does Windows Azure support wildcard SSL ?  For example, can I create an SSL certificate issued for *.mydomain.com and use it in Windows Azure?

       Q. How do I configure HTTPS for multiple sites with 2 different SSL certificates on a single IP address and single port number: 443.

       Q. Unable to perform VIP Swap, due to changes in the endpoints of my staging and production deployments. How do I roll out a new deployment without downtime?

Configuring a CNAME (Canonical Name)

When you create an application in Windows Azure, Windows Azure provides a friendly subdomain on the cloudapp.net domain, so your users can access your application on a URL like https://<myapp>.cloudapp.net. If you want to expose your application on your own domain name, you need to configure a CNAME on your domain registrar. With a CNAME, you map a specific domain, such as www.mydomain.com, to the <myapp>.cloudapp.net domain name of your Windows Azure hosted application. Note, however, that most domain registrars only allow you to map subdomains, such as www.contoso.com and not root names, such as contoco.com or *.contoso.com.

• Ø  Assume you have a domain name mydomain.com. This is your root domain
• Ø  In your domain provider, register a CNAME, mapping your subdomain www.mydomain.com to <myapp>.cloudapp.net. 
• Ø  CNAME works as an alias.

(For your reference I have provided a screen shot of one of the domain provider. Please check the last row in the screen shot).

 The following will happen when a request comes in with your subdomain:

         www.mydomain.com              CNAME      myapp.cloudapp.net

        www.myapp.cloudapp.net       A                  VIP address

When an A record lookup for www.mydomain.com is done, the DNS resolver will see a CNAME record and restart the checking at www.myapp.cloudapp.net and will then return VIP address. VIP address is the load balancers IP address, through which requests, gets routed to one of the instances of your application. If you delete your deployment and rollout a fresh deployment, VIP address is subjected to change. So, by configuring a CNAME in your domain registrar, you will not have to worry about the DNS mapping, even if the VIP address changes.

A visitor of www.mydomain.com  will never see the true host (myapp.cloudapp.net), so the forwarding process is invisible to the end user. Note: The example above only applies to traffic at the www subdomain.

You cannot specify a root CNAME record that directs all traffic from a custom domain to your cloudapp.net address, so additional alias records must be added. If you want to direct all traffic from a root domain, such as mydomain.com, to your cloudapp.net address, you can configure a URL Redirect or domain forwarding in your DNS settings. CNAME records have one limitation: they need to map a specific subdomain. It’s not possible with a CNAME record to map the root domain itself, which is why we needed to do domain forwarding.

Domain forwarding

Use domain forwarding to map the root domain (mydomain.com) to the subdomain (www.mydomain.com).

SSL Certificate for Windows Azure Cloud Applications

If you get an SSL certificate issued for <myapp>.cloudapp.net, you will not be able to get this certificate verified (a mandatory validation step by Certificate Authority). This is because cloudapp.net domain is owned by Microsoft. So, you will have to get the SSL certificate issued for your domain name or wildcard name ie *.mydomain.com. You will be able to verify this certificate for the certificate authority, because you own your domain.

If you are trying to configure HTTPS for multiple sites in a single webrole with 2 different certificates on a single IP address and single port number: 443.

This is not possible because, with this design IIS is left with only host header name to distinguish between the sites. The host header name is encrypted in the SSL blob when the client sends a request. Because the host header name is part of the binding, IIS needs the host header name to lookup the right certificate. Without the right choice of certificate, IIS can't decrypt the SSL blob that contains the host name. Without the host name IIS can't look-up the right site.

Host headers were never supported on any SSL binding because that part of the packet (header) is encrypted. We must have a unique IP address for any 443 SSL binding.This explains the limitation in IIS. Alternatively, you can get a wildcard certificate or a SAN (Subject alternative name) certificate for your domain. You can use this certificate for all your subdomains and root domain.

Using CNAME to roll out new deployments without downtime

In order to do enable HTTPS for your application (currently running on HTTP) you will need to change the service model. Because you are changing the number of endpoint to your service, you cannot perform VIP Swap with no-downtime deployment but you can use the following workaround:

• Create new hosted service in Windows Azure. For example mynewservice.cloudapp.net
• Deploy and run the new code on the new hosted service.
• Go to your domain registrar and change the CNAME mydomain.com to point to mynewservice.cloudapp.net
• Wait at least 24 hours before deleting something.cloudapp.net

The no-downtime will be handled by the DNS servers - if you try to access your website’s URL www.mydomain.com and if your DNS server was already updated with the new CNAME, you will hit the new bits. If your DNS server wasn’t updated with the new CNAME, you will hit the old service.After some time (based on the TTL set for the CNAME which is typically 24h) all DNS servers around the world will be updated with the new CNAME, and everybody will hit the new bits.