Take the 2-minute tour ×

I have an application on Azure, and I would like to configure several domains, with HTTPS access enabled that all point to the same Azure instance/webrole.

I heard that you cannot have 2 certificates bound to the same IP/PORT but I am sure there is way to do this.

share|improve this question
Do you want more than one domain pointing to the very same web application (Azure Web Role), or do you want to have each domain having its own Web Application. If you are targeting the latter, it is just an IIS related question, which I don't know the answer of, and is not Azure related. If you are targeting the former, where every domain would have it's own Web Application, this must be configurable via the "Sites" element in the service definition file. –  astaykov Nov 2 '11 at 9:39
I need the former: multiple domains all with HTTPS support, that run the same Web Application. I will look into that. Thanks. –  Fabien Warniez Nov 4 '11 at 15:25
This is something (very frustrating to me also!) that is not supported by IIS today actually. I was trying to configure IIS 7.5 with 2 different websites to bind to HTTPS on the same IP Address with different certificates and this seems unfeasible. Strange indeed .. –  astaykov Nov 5 '11 at 18:50
Just confirmed, you have to either use a SAN (Subject Alternative Name) SSL certificate on the signle endpoint with multiple host headers. Or you have to use different PORT for every additional HTTPS site you would like to have. And this is not Azure limitation, it is IIS / HTTPS nature limitation. –  astaykov Nov 5 '11 at 19:17
If I understand well, a SAN certificate is a certificate for multiple domains, right? –  Fabien Warniez Nov 7 '11 at 14:08
show 1 more comment

1 Answer

up vote 1 down vote accepted

My understanding of how HTTPS works is that you can't have two different certificates for the same IP address. (How would IIS know which certificate to use when a new connection came in?)

Try to get it set up first on IIS locally. If you can manage to make it work there, you can presumably do it in Windows Azure (but please do let me know how!).

share|improve this answer
"How would IIS know which certificate to use when a new connection came in?": the same way it does it for web applications, depending on the domain requested? I thought it could work the same way. Thanks for your answer anyway. –  Fabien Warniez Nov 4 '11 at 15:26
No, IIS can't do that today. (At least, that's my understanding.) The host name isn't known until after the secure connection is established. If IIS can do it, then Windows Azure can to. –  smarx Nov 5 '11 at 1:08
Very clear, thanks. –  Fabien Warniez Nov 7 '11 at 13:32
What about SNI? Is it something possible on Azure? en.wikipedia.org/wiki/Server_Name_Indication –  Fabien Warniez Nov 7 '11 at 15:18
I don't know. Again, if IIS can do it, Windows Azure can do it. –  smarx Nov 7 '11 at 16:15
show 2 more comments

Your Answer


