This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I created Azure CDN classic and defined a custom origin. The origin is my WordPress website (outside of Azure).
Currently, my website is open at https://mywebsite.azureedge.net and also https://mywebsite.com.
The first question is whether I should create a CNAME record like the below that my website traffic redirects to Azure CDN. Is it right?
The second question is, how can I enable TLS 1.3 on Azure CDN?
With https://www.cdn77.com/tls-test I tested TLS on both URLs.
The result of my website:
The scenario is, I hosted my website on sharing host that it's not possible to disable TLS 1.1 and 1.0. To fix this issue I should change my hosting plan to VPS.
I want to move my website, behind Azure CDN to fix TLS versioning.
@Mohsen Akhavan , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.
And, if you have any further questions do let us know.
Hi,
Currently TLS 1.3 is not supported. Please see Supported TLS versions in below article:
https://video2.skills-academy.com/en-us/azure/cdn/cdn-features
Please click Accept Answer if the above was helpful.
Thanks.
-TP
@TP , Thanks for your response. One question, After I added a custom domain when I tested with this URL (www.mydomian.com) TLS 1.0, 1.1 are disabled but when I tested with this address (mydomain.com) show me old TLS 1.0, and 1.1 are enabled. Do you have any idea?
Hi,
First, make sure you set Minimum TLS version to 1.2 for your domain. When you added the domain the minimum TLS version option was at the bottom of the window. Now that your domain is added, you need to go to the Domains blade and click on Certificate type link and a flyout window will open that allows you to set minimum TLS.
Second, how are your DNS entries configured? It sounds like request for apex domain are being sent to different server compared to www.
Thanks, I configured TLS.
My website is hosted on a VPS that it's outside of Azure. I have a Plesk panel on this VPS. In DNS (plesk) I have A record like the below:
| mywebsite. | A | 1.2.3.4 | |
|---|---|---|---|
Now I created a CDN profile and endpoint with the below items:
endpoint hostname: https://mywebsite.azureedge.net
origin hostname: https://mywebsite.com
After that, I create a custom domain in Azure CDN:
www.mywebsite.com
And also a CNAME record on my DNS:
| www.mywebsite.com. | CNAME | mywebsite.azureedge.net. | |
|---|---|---|---|
Now, my issue is when I PING www.mywebsite.com I resolved CDN's IP, and when I Ping mywebsite.com, I resolved my VPS's IP. Also, when I test TLS versioning for both of them, only the www.mywebsite.com result is correct, and the same with my configuration in CDN. I think all traffic doesn't go through Azure CDN.
Both of the public FQDNs for your website need to have DNS records pointing to your endpoint. So in your example both mywebsite.com AND [www.mywebsite.com] need to be pointing to mywebsite.azureedge.net. That way all requests to your site will go to Azure edge servers.
You can create a new name for your origin server, for example, originserver.mywebsite.com with an A record pointing to public IP address of your VPS. If you have wildcard certificate on your VPS then switching to a new host name shouldn't be an issue.
Please let me know if you have any questions and/or you need clarification.
In my example, I tried to create a DNS record to point to my endpoint. For www.mydomain.com I made a CNAME record pointing to my endpoint in Azure CDN. But my problem is how can I point mydomain.com to the endpoint? If I created an A record, I need an IP. Also, it's not possible to create another CNAME record for mydomain.com FQDN.
Could you please clarify the origingserver.mywebiste.com method? FYI, I don't have a wildcard certificate.
You need to create CNAME or ALIAS record for your apex domain and point that to Azure CDN. If your DNS provider does not allow it then you can have your DNS servers hosted with a provider that does.
You don't need a wildcard certificate. I mentioned it because if you currently were using one switching the FQDN in use at your VPS would be less work.
In regards to originserver.mywebsite.com what I am suggesting is you need to change the FQDN that points to your VPS since "mywebsite.com" (your apex domain) needs to point to Azure CDN instead of your VPS. So you could create A record for "originserver.mywebsite.com" that points to your VPS, and in your control panel make the appropriate changes to reflect new name, switch ssl certificate, and finally update your Azure CDN configuration so that origin is originserver.mywebsite.com
Does the above make sense?
Hello @Mohsen Akhavan ,
Apologies for the delay in response.
I understand that you created Azure CDN classic and defined a custom origin and have a few questions regarding CNAME mapping and TLS version support, which I've answered below:
Whether I should create a CNAME record like the below that my website traffic redirects to Azure CDN?
Yes, you need to create a CNAME with the below entry:
After that follow the steps in the above document to add the custom domain to your CDN endpoint.
How can I enable TLS 1.3 on Azure CDN?
Currently TLS 1.3 is not supported. Azure CDN Standard from Microsoft supports TLS 1.2, TLS 1.0/1.1.
Refer: https://video2.skills-academy.com/en-us/azure/cdn/cdn-features
For www.mydomain.com I made a CNAME record pointing to my endpoint in Azure CDN. How can I point mydomain.com to the endpoint? If I created an A record, I need an IP. Also, it's not possible to create another CNAME record for mydomain.com FQDN.
This scenario is mentioned in the below document: https://video2.skills-academy.com/en-us/azure/cdn/onboard-apex-domain?toc=%2Fazure%2Ffrontdoor%2FTOC.json
Azure CDN uses CNAME records to validate domain ownership for onboarding of custom domains. CDN doesn't expose the frontend IP address associated with your CDN profile. You can't map your apex domain to an IP address if your intent is to onboard it to Azure CDN.
The DNS protocol prevents the assignment of CNAME records at the zone apex. For example, if your domain is contoso.com; you can create CNAME records for somelabel.contoso.com; but you can't create a CNAME for contoso.com itself.
This problem can be resolved by using alias records in Azure DNS. Unlike CNAME records, alias records are created at the zone apex.
Mapping your apex or root domain to your CDN profile requires CNAME flattening or DNS chasing. A mechanism where the DNS provider recursively resolves the CNAME entry until it hits an IP address. This functionality is supported with Azure DNS for CDN endpoints.
There are other DNS providers as well that support CNAME flattening or DNS chasing, however, Azure CDN recommends using Azure DNS for its customers for hosting their domains.
Now, if your DNS provider supports CNAME flattening or DNS chasing, you should be able to add an alias record or enable CNAME flattening for the root domain.
So, you need to contact your DNS provider and check if they support CNAME flattening or if there is any way to achieve this on their end. If it is not supported with your DNS provider, then maybe you could delegate your domain to Azure DNS and manage your DNS records in Azure DNS and here you will be able to create an Alias record which will help you onboard your apex domain to Azure CDN.
Please refer: https://video2.skills-academy.com/en-us/azure/dns/dns-domain-delegation
https://video2.skills-academy.com/en-us/azure/dns/dns-delegate-domain-azure-dns
Kindly let us know if the above helps or you need further assistance on this issue.
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
@GitaraniSharma-MSFT Thanks for your response. Let me test and I will back you. Just clarify these steps are a recap of the configuration:
Is it right?
P.S : in Place of Step4, you should create an Alias record to the CDN EndPoint (for Apex domain)