The following forum(s) are migrating to a new home on Microsoft Q&A (Preview): Azure Virtual Machines!

Ask new questions on Microsoft Q&A (Preview).
Interact with existing posts until December 13, 2019, after which content will be closed to all new and existing posts.

Learn More

 none
Multiple IP addresses for a VM to be able to use Multiple HTTPS endpoints RRS feed

  • Question

  • The Windows Azure VMs is not attractive for the users who want to host multiple web sites inside a VM and serve them through HTTPS because in order for HTTPS to work, we need to assign individual IP addresses to each HTTPS endpoint (note: I know that there are workarounds for this such as using different ports, using UCC SSL certificate or using  Server Name Indication (SNI) which should require browsers to be compatible as well).

    I would like to know if there is any plan to address this problem in the future because this is a blocking issue for us.

    Thanks in advance.


    Tugberk Ugurlu


    Thursday, September 13, 2012 11:48 AM

Answers

  • That's it - I am finished with Azure VMs. I have been selling and installing MS systems for 15 years now and was just getting excited about the potential of Azure and the you do something like this. How anyone in MS thought that PAT would be flexible enough to address all of the different network topologies a service provider requires is beyond me.  This is my scenario....

    I am just after winning a contract to customise & host CRM 2011. I was hoping to do this on Azure but alas I need two public IPs for federation services to work with CRM in IFD mode and Azure cannot do this. I just spent the last two days building my VMs and now I hit this roadblock. I am happy to say, it is not a problem. It took me just one hour to get to the same place on Amazon Web Services and I have complete flexibility with regards to IP addresses. From now on, I will recommend AWS for all of my clients hosting requirements. It would be too risky to do otherwise.

    Bye Bye Azure. Your interface is lovely but it just didn't work out. :(  

    Friday, February 8, 2013 5:40 PM
  • Guys, I know we need the multiple public IPs per VM. Let's hope MS is working on this day and night cause it's vital.

    In the meantime, perhaps you can consider provisioning a new virtual machine (XS) to get the new public IP and install IIS ARR on it to forward requests to your main VM(s) via a Virtual Network. You can also host the HTTPS certificate on the ARR server to avoid CPU load on your main server for the encryption/decryption effort that comes with SSL. An Extra Small VM is just €11 per month, which should be very similar to the cost of getting an extra public IP.

    Just my 2c as a workaround until MS release the much needed update.

    Thursday, April 3, 2014 9:27 AM
  • Hi Tugberk,

    I confirmed that this is something the product team is looking into and will address as part of a future release, but we do not have a firm timeline yet.

    Thanks,
    Craig

    Thursday, September 13, 2012 7:16 PM
    Moderator

All replies

  • Hi Tugberk,

    I'm following up with the product team to confirm.

    Thanks,
    Craig

    Thursday, September 13, 2012 7:00 PM
    Moderator
  • Thanks Craig!

    Tugberk Ugurlu

    Thursday, September 13, 2012 7:12 PM
  • Hi Tugberk,

    I confirmed that this is something the product team is looking into and will address as part of a future release, but we do not have a firm timeline yet.

    Thanks,
    Craig

    Thursday, September 13, 2012 7:16 PM
    Moderator
  • +1

    I need this as well.  It would be nice to setup additional virtual IP's for a single VM and then be able to add additional VM's at a later point to scale up and keep the same VIP.

    Thanks!

    Jon Kragh

    Wednesday, October 17, 2012 12:05 PM
  • Hi Tugberk/Jon,

    I am not aware of any new guidance we have around when this feature may be introduced, but I've followed up again with the product team to confirm and I will update the thread if they are able to share anything new.

    Thanks,
    Craig

    Saturday, November 3, 2012 2:12 PM
    Moderator
  • Hey Jon,

    Thanks for this additional feedback and suggestion! This is really valuable to us. i am wondering, would you consider sending a few more details on what you plan to do with these multiple IPs and additional requirements you have on them to IaaSForum@microsoft.com. We would be interested in hearing a bit more... :)

    Corey

    Sunday, November 11, 2012 9:25 AM
    Moderator
  • I have the same issue. I have 3 certificates that I have invested money in that are non-transferable. Currently, all I have to do is use one website in IIS and get three IPs to assign 3 certificates to the same site.

    There is no way to replicate this in Azure exactly.

    I personally do this because I run many domains off the same site and need each of them to have their own secure certificate. I happened to buy mine separately as I grew and was planning on continuing to do so. I'm sure there are many other use cases that can lead to this problem though.

    I have considered running 3 separate instances but that costs thrice the price and multiple publishes.

    I have considered deploying the same code to 3 sites on the same instance, but I want all subdomains to go to a site (there is no way to bind  *.example.com) so I use the blank header to capture all requests not otherwise bound specifically. This is fine, but when you bind 443 SSL, you use the IP as the differentiator allowing you install multiple certificates.

    I have considered changing my architecture to use one global certificate, but that is too painful at the moment.

    My thought was that if we could buy additional IPs for a particular deployment, we could configure the IP we wanted to use for a binding as just another attribute of the Binding node in ServiceDefinition file.

    Allowing for this simple addition would solve my problem and open the Azure platform to a wider variety of web applications lead to a new level of adoption of your services (which are amazing by the way), IMHO.

    Thank you for your time and consideration.

    (The forum email provided bounces.)

    • Edited by onemanclic Thursday, November 29, 2012 3:24 AM
    Thursday, November 29, 2012 2:58 AM
  • My feelings towards the azure platform are one minute i'm in awe at its features and flexibility and the next totally disappointed that niggles like this one have not been addressed. I just went through the excitement of creating a new virtual machine to move my websites onto only to find that I can only have a single IP address.
    Saturday, December 29, 2012 11:17 AM
  • +1

    Critical for us as well.

    Wednesday, January 2, 2013 8:34 PM
  • I have a similar issue, but not with external IP addresses.  A customer scenario needs multiple INTERNAL IP's (specifically 2). 

    This seems to not be possible at the moment.

    http://social.msdn.microsoft.com/Forums/en-US/WAVirtualMachinesforWindows/thread/dba5a25a-0b12-4620-8f3a-a71c3e5b3555

    Saturday, January 12, 2013 6:51 AM
  • So where are we with this?  Trying to host website.com and m.website.com, both with its own certificate, on same VM.  Does work with SNI, but then huge client base is still left out (most notably, Android 2.X).
    Friday, January 25, 2013 9:27 PM
  • Hi Craig

    Any update on this? I also have a client currently in an Azure VM trial period and they need multiple VIPs to scale their offering. If Azure cannot do it, we will have to move them to AWS and I really do not want to do that.

    Thanks

    John

    Wednesday, January 30, 2013 1:20 PM
  • Could you please update us as to why this has been such a difficult issue to resolve?  I know that it's been active for over two years now and that many key clients have left over it.  What's so difficult with making this happen?  Multiple IPs is one of the most important features that people need yet the information on it is sparse at best.

    I understand that VNets are a software solution, is that part of the issue?

    I would really like to have some more technical details on this.  In reality, you are going to lose a ton of business over this one item, perhaps being more transparent would help, you might even find a solution from all of us who need this.

    Tuesday, February 5, 2013 8:13 PM
  • That's it - I am finished with Azure VMs. I have been selling and installing MS systems for 15 years now and was just getting excited about the potential of Azure and the you do something like this. How anyone in MS thought that PAT would be flexible enough to address all of the different network topologies a service provider requires is beyond me.  This is my scenario....

    I am just after winning a contract to customise & host CRM 2011. I was hoping to do this on Azure but alas I need two public IPs for federation services to work with CRM in IFD mode and Azure cannot do this. I just spent the last two days building my VMs and now I hit this roadblock. I am happy to say, it is not a problem. It took me just one hour to get to the same place on Amazon Web Services and I have complete flexibility with regards to IP addresses. From now on, I will recommend AWS for all of my clients hosting requirements. It would be too risky to do otherwise.

    Bye Bye Azure. Your interface is lovely but it just didn't work out. :(  

    Friday, February 8, 2013 5:40 PM
  • +1 more

    We are very much in need of this feature as well. 

    Tuesday, February 19, 2013 10:36 PM
  • In order to move from our existing hosting environment we would need this feature also. Again it is to do with hosting multiple SSL certificates on IIS. I would be happy with an option to purchase additional IP addresses.
    Tuesday, March 19, 2013 12:16 PM
  • We need this feature as well.  I was ready to recommend Azure to our company, but we have 25 SSL websites each currently hosted on a separate IP address.  I see no way to set up a similar system in an Azure VM.
    Thursday, April 25, 2013 9:11 PM
  • Hi Craig,

    any news?

    Monday, May 20, 2013 8:09 PM
  • Yep waiting on this as well.  Ready to sign up for 24 Large and X-Large VM's. This is holding us up!
    Wednesday, May 22, 2013 6:37 AM
  • Ugggg.. didn't realize this was an issue till now. After we moved one site with an ssl over.
    Tuesday, June 4, 2013 5:28 PM
  • I received an update from Microsoft with an announcement of the following preview technology:

    Preview of SSL for sites hosted on Windows Azure Web Sites Reserved instances with custom domain names

    Secure Sockets Layer (SSL) helps you secure traffic to your sites with custom domain names hosted on Windows Azure Web Sites.

    SSL is a key piece of technology for companies that want to do business on the web and is used to help secure traffic between the website and the browser. We are announcing support for SNI-based and IP-based SSL certificates for Web Sites Reserved instances. SNI is supported by most modern browsers in use today. SNI-based SSL allows websites without a dedicated IP address, which is a key feature for websites hosted in cloud environments. IP-based SSL works in all browsers. For more information on SSL, please refer to the Web Sites Services webpage.

    ---

    The email included a table that basically said that SNI SSL is going to be $9 per month per website and only supports "modern browsers" and IP SSL is going to be priced at $39 per month per website.

    Our company can’t rely upon the SNI approach since it only supports modern browsers.  Plus, $9 a month is too high when most other providers charge $1-$2 per public IP and we can host our own SSL certificate directly in IIS.  Considering our company has 25 SSL sites that we are hosting, the pricing for IP SSL precludes us from using it.   I'm sad because I like everything else about Azure.
    Thursday, June 20, 2013 1:31 PM
  • Just adding my vote for the ability to purchase additional IPs, without this AzureVM is useless for me.
    Monday, February 24, 2014 7:27 PM
  • +1

    This is completely ridiculous. I challenge anybody to name another hosting provider that doesn't offer multiple IP addresses on a VM. It's like saying you can only have 1 user account or 1 virtual directory or something completely inane like that. I can't believe that Azure doesn't support this. This is forcing us to go to AWS.

    This thread started in 2012, it is now well into 2014. WHEN WILL THIS GET RESOLVED????  If the answer is never, then just tell us that so we can stop asking for it.

    Monday, March 10, 2014 1:03 PM
  • This is also a show stopper for us as well. We host a lot of websites, most of them using SSL certificates that have already been purchased.

    We were considering a migration to Azure services at the latter part of this year; however this presents a big problem for us.

    Azure gets a tick in every other box thus far but unfortunately, everything is riding on the multiple public IP addresses per VM issue.

    Our statistics also indicate that a lot of legacy browsers are still used, we cannot ignore that. SNI is not really an option.

    We may be forced to go with AWS as others have suggested.


    • Edited by Carl Davey Monday, March 31, 2014 9:49 PM
    Monday, March 31, 2014 4:01 PM
  • Is there any update on this topic?
    I have a customer that needs two IP addresses to be used for two separate SSL websites. They currently have an Azure server and I wanted to know if this is at all possible? Can one just purchase an additional VIP so that this configuration will work?


    Wednesday, April 2, 2014 9:43 AM
  • Guys, I know we need the multiple public IPs per VM. Let's hope MS is working on this day and night cause it's vital.

    In the meantime, perhaps you can consider provisioning a new virtual machine (XS) to get the new public IP and install IIS ARR on it to forward requests to your main VM(s) via a Virtual Network. You can also host the HTTPS certificate on the ARR server to avoid CPU load on your main server for the encryption/decryption effort that comes with SSL. An Extra Small VM is just €11 per month, which should be very similar to the cost of getting an extra public IP.

    Just my 2c as a workaround until MS release the much needed update.

    Thursday, April 3, 2014 9:27 AM
  • +1 for needing this. We really don't want to move from Azure, but this is a show-stopper.
    Tuesday, May 6, 2014 4:27 PM
  • Indeed a big problem for my company!

    I have migrated everything of my websites to the azure cloud. And we use http (port 80) normally.
    Now since a short time, we wanted to use a few websites with SSL https (port 443).

    Then i changed some ports of some websites and could use them in some iframes. But affortunately i ran in some problems, that some customers use intranets who blocked all ports but 80 and 443. 

    Now i have a big problem too! first, i used dynamically IP's, so i changed all to NAMES. Everything worked great, until i need some HTTPS sites now..

    so my problem is, that i need to create new vm's and configure everything again. but first i have to know if i can get multiple IP-addresses too, and second to address them to my webserver vm with multiple internal ip-addresses..

    So, i hope ms can do something about this.. because it's to crazy to run an extra vm, just for 1 little website app.. 

    best regards,


    Fandy Backers

    Thursday, July 31, 2014 6:39 PM
  • We host several hundred websites, some on shared IP's and others using a dedicated IP.  All of our servers have multiple IP addresses assigned, for multiple reasons.  Sometimes it's because of SSL certificates as others have mentioned, sometimes it's just because the server performs multiple roles.

    Sometimes software doesn't play well with others and requires its own dedicated IP (or even its own virtual NIC card) for binding.

    Our entire environment is virtualized with Hyper-V so it made sense to backup our VHD's offsite to Windows Azure.  If there were a disaster at the data center, I can just spin up new VM's in Azure, change some DNS entries to point to the IP's of these new VM's, and we could be back up and running fairly quickly.

    Oops, no I can't.  There is no way to assign multiple external IP's to a VM in Azure.

    Wednesday, August 20, 2014 8:24 PM
  • Two years later and the same thing? I'm going to have to move my site also to another provider.
    Tuesday, October 7, 2014 4:24 AM
  • You gotta be kidding me, Microsoft. Two years and not a peep?

    Zachary

    Wednesday, December 17, 2014 10:15 PM
  • Indeed pretty incredible this isn't possible and MS isn't even responding.
    Friday, June 19, 2015 1:42 PM