We need to use two ssl certificate files on one wild-card domain (*.mydmain.io) on Azure Application gateway. I already sat up it for using one ssl-cert and it workes fine but I need to add one more cert for it. As I went through the setup I couldn't see a way to add several certificates under one listener.
Is there any way to make this happen?
I have created an aks cluster and deployed an application there and exposed it as a service.
Can be accessible through LoadBalancer.
To access it internally, I created a windows VM in the same vnet (different subnet) of aks cluster and tried to access the application using cluster IP, but can't access it.
Any suggestions?
Because I got the similar issue with application gateway also, so tried this VM now but same issue.
Question
What is the correct way to configure an Azure Application Gateway to be able to handle requests which use a host header with only a hostname (i.e. not a fully qualified domain name) due to clients relying on their DNS search suffix list to handle this.
Detail
We have an Azure Application Gateway which is configured with a Private IP to act as a load balancer for a variety of internal websites / web applications.
Since we're handling multiple sites on this app gateway, I've configured multi-site listeners, which rely on the HTTP/1.1 Host Header to correctly route requests to the relevant backend.
Many of these sites have FQDNs which are on our primary domain suffix; e.g. reporting.domain.example.com. Because our primary domain is in our client device's search suffix list, this means that normally they'd be able to type reporting and have DNS resolve this to reporting.domain.example.com, taking them to the correct place. However, the browser doesn't send the DNS resolved FQDN, but sends the user entered hostname in the host header value. This means that my listener won't get the full name it expects.
I can work around this; creating a listener configured with the hostname without the DNS suffix to capture requests which arrive this way; and I can even handle HTTPS as we have an our own trusted certificate authority (i.e. AD Certificate Services), so can issue certificates which include both FQDN and the short name form in their SAN list.
However, I found an oddity after setting up a few sites... with listeners configured like below:
example1.domain.example.com -> redirects to an external siteexample1 -> redirects to listener example1.domain.example.comexample1-test.domain.example.com -> sits over a backend poolI found that requests made to https://example1-test.domain.example.com were being redirected to the external site configured on listener example1.domain.example.com.
I tested with Chrome's Developer Tools' Network > Disable Cache option checked to ensure I wasn't being affected by cached 301s, double checked the app gateway's configuration to ensure I'd not mapped the listener to the wrong request routing rule, or configured the rules incorrectly, and deleted and recreated the listeners and rules in case something had become corrupted; but with no joy.
When I changed the hostname of the example1 listener to XXXexample1 I found that example1-test.domain.example.com started working as expected.
I've not found any documentation on this setup, so don't know if it's a bug, if what I'm trying is unsupported, if the listener isn't using a string but some form of pattern matching/regex equivalent, or if there's some other official way to handle this scenario instead of the method I "discovered".
I would like to know the difference between timeTaken_d and clientResponseTime_d
please find the query below
AzureDiagnostics | where Category == 'ApplicationGatewayAccessLog' | project timeStamp_t, timeTaken_d, clientResponseTime_d, serverResponseLatency_s, httpStatus_d, requestUri_s, instanceId_s
When adding a second multisite HTTPS listener on an application gateway, I get the below exception:
Failed to save configuration changes to application gateway 'MyAppGateway'. Error: Either Data or KeyVaultSecretId must be specified for Certificate 'MyResourceGroup/providers/Microsoft.Network/applicationGateways/MyAppGateway/sslCertificates/myCertificateName'>MyAppGateway/myCertificateName' in Application Gateway.
This error occurs regardless of whether I use the same certificate for both listeners (with the different domains covered by the SAN list), or configure individual certificates per listener.
Once I've hit this error, I can't update the application gateway in any way / the only fix seems to be to delete it.
Is this a known issue, or am I doing something wrong? I'm following the steps as described here; only I'm using a self-signed certificate for the initial SSL cert (i.e. rather than getting LetsEncrypt to issue the initial certificate / since it will be overwritten anyway). When I did a POC of this for a single site all worked as expected; so the issue seems to relate to my use of the multi-site feature (i.e. having different FQDNs pointing to the shared public IP of the app gateway, then routing the requests to different backends based on the host header values).