{"id":1162,"date":"2019-05-27T01:37:32","date_gmt":"2019-05-27T01:37:32","guid":{"rendered":"https:\/\/www.ciraltos.com\/?p=1162"},"modified":"2023-03-23T23:18:17","modified_gmt":"2023-03-24T04:18:17","slug":"how-to-configure-an-azure-cdn","status":"publish","type":"post","link":"https:\/\/www.ciraltos.com\/staging2\/how-to-configure-an-azure-cdn\/","title":{"rendered":"How to configure an Azure CDN"},"content":{"rendered":"\n

A Content Delivery Network, or CDN, is a globally\ndistributed network for delivering, well, content.  Content can include images, videos, CSS and\nany other asset used for providing web services.  The advantages to a CDN include: caching data\ncloser to the users to increase web site performance, improving reliability by\nleveraging a global caching network and reducing bandwidth by shifting traffic\nto the CDN.  <\/p>\n\n\n\n\n\n\n\n

Microsoft Azure provides several CDN options backed by Azure, Verizon or Akamai.  This post covers deploying a CDN backed by Azure with a custom domain name.  Azure CDN is backed by Azure Front Door Service and is suitable for general web delivery, video streaming, and large files.  Azure CDN supports custom DNS names and provides a free SSL certificate for custom host names.<\/p>\n\n\n\n

Video Version Here:<\/h2>\n\n\n\n

https:\/\/youtu.be\/1wcGZz9qn8M<\/a><\/p>\n\n\n\n

What is a CDN<\/h2>\n\n\n\n

At a high level, Azure CDN works by caching data from a\nsource to the CDN based on the request of the client.  The client requests the content based on a\nspecific DNS hostname.  The CDN determines\nthe location of the client based on the DNS lookup.  Content is copied from the source and cached locally\nto the client. The next time a client requests the content, it\u2019s pulled from\nthe local cached, speeding delivery by moving the content closer to the client.<\/p>\n\n\n\n

\"\"<\/a>
CDN Overview Animation<\/figcaption><\/figure>\n\n\n\n

Create the Storage Account<\/h2>\n\n\n\n

The example below uses an Azure Storage Account blob\ncontainer to host the source content. \nStart by creating a new Resource Group and Storage Account.  The Storage Account and CDN will go into the\nsame Resource Group.  The Storage Account\ncan be V1 or V2, for this example, I\u2019m creating a V2 Storage Account.<\/p>\n\n\n\n

\"\"<\/a>
New Storage Account<\/figcaption><\/figure>\n\n\n\n

Once the storage account is created, create a new blob\ncontainer to store the CDN content.  Set\nthe Public Access Level<\/em> to Blob (anonymous read access for blobs only).\n<\/em>the CDN will only propagate content that is publicly accessible.  As this is content to a public web site,\nmaking the content publicly available is necessary.<\/p>\n\n\n\n

\"\"<\/a>

New Public Container<\/figcaption><\/figure>\n\n\n\n

Create the CDN<\/h2>\n\n\n\n

Next, go to Azure CDN <\/em>under\nBlob service <\/em>in the Storage Account\nmanagement blade.  From there, set up a\nnew CDN profile.  A profile can hold\nmultiple endpoints, providing they are the same pricing tier and provider.  Enter a name for the new profile and move\nonto pricing tiers.  <\/p>\n\n\n\n

There are four options for Pricing tiers.  I use Standard\nMicrosoft<\/em> in this example.  More\ninformation on the different pricing options can be found here.<\/p>\n\n\n\n

\"\"<\/a>
CDN Pricing Tiers<\/figcaption><\/figure>\n\n\n\n

Give the CDN an endpoint name after the pricing tier is\nselected.  This name is part of the URL\nand has to be globally unique.  This will\nalso be the CNAME alias if using custom domain names.  <\/p>\n\n\n\n

The finished endpoint will look similar to below.  Click Create<\/em>\nto set up the endpoint.<\/p>\n\n\n\n

\"\"<\/a>
New CDN Endpoint <\/figcaption><\/figure>\n\n\n\n

The CDN Endpoint is now running, but there is nothing in the source Storage Account for the CDN to serve.  Any simple HTTP code will work for testing.  I will deploy a static web site available here <\/a>For this example.<\/p>\n\n\n\n

Azure Storage Explorer is used to upload the content to the\nroot of the \u201csource\u201d container setup previously.<\/p>\n\n\n\n

\"\"<\/a>
Azure Storage Explorer <\/figcaption><\/figure>\n\n\n\n

Now that the CDN is set up and content is available, it\u2019s\nready to test.  In Azure, Go to CDN<\/em>, Select the CDN Profile <\/em>and the Endpoint<\/em>\nwe just created.  Under settings, there\nis an option for Endpoint hostname<\/em>.  This is the URL used to access the\ncontent.  <\/p>\n\n\n\n

\"\"<\/a>
CDN URL
<\/figcaption><\/figure>\n\n\n\n

Clicking on the URL will display the message \u201cThis XML file\ndoes not appear to have any style information..\u201d.  <\/p>\n\n\n\n

\"\"<\/a>
XML Message
<\/figcaption><\/figure>\n\n\n\n

This is expected.  A\nCDN is not a web server.  It doesn\u2019t\nassume you are looking for index.html if you don\u2019t add it to the path, and it\nwon\u2019t redirect to a virtual directory.  A\nCDN is used to reference content by an absolute and explicit path.  For my example, I uploaded the content,\nincluding the *index.html* file to the *source* directory.  If I add \/source\/index.html to the end of the\nhostname I can access the web content.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Congratulations, if you are following along you now have a\nfunctioning CDN.  Before we move on,\nlet\u2019s cover some of the features you may need to use for administering the CDN.<\/p>\n\n\n\n

The Purge<\/h2>\n\n\n\n

Go back to the CDN Endpoint. \nAt the Overview<\/em> blade, notice\nthe four buttons at the top.  <\/p>\n\n\n\n

\"\"<\/a>
Overview Buttons <\/figcaption><\/figure>\n\n\n\n

I will cover the Custom\nDomain<\/em> option later and you can probably figure out that Stop <\/em>will stop the CDN and Delete<\/em> will delete it.  The Purge<\/em>\nOption is helpful if you update content at the source and need to clear\noutdated content from the global CDN cache. \nClick Purge <\/em>and add the path\nto the content to remove from the cache. \nYou can also use a wildcard * to remove all content from a given directory.  Select the Purge All <\/em>option to remove all content from the global cache.<\/p>\n\n\n\n

\"\"<\/a>
Content Purge <\/figcaption><\/figure>\n\n\n\n

There are other options under Settings<\/em>.  You can update the\ncontent source, change Compression method and Caching rules as well as\nimplement Geo Filtering.  Go to Origin<\/em> and notice that adding an origin\npath of \/source<\/em> from the example in\nthis post will eliminate the need to add \/source to the URL.  The option to remove HTTP or HTTPS and change\nthe origin port is also available under Origin<\/em>\nsettings.<\/p>\n\n\n\n

\"\"<\/a>
Origin <\/figcaption><\/figure>\n\n\n\n

So far, we have used an azureedge.net domain to access the\nCDN.  What if you want to add your own\ncustom domain?  This can be done in two\nsteps.  The first step is to add a CNAME\nto your DNS that points your custom domain and hostname to the azureedge.net\ndomain of the CDN.  For my example, I\nadded a CNAME record that points cdn.ciraltos.com to cirtestcdn.azureedge.net.  This record has to be added and propagated before<\/em> continuing to the next step.  Each DNS provider is different, consult their\ndocumentation for help added a CNAME record.<\/p>\n\n\n\n

\"\"<\/a>
Add CNAME <\/figcaption><\/figure>\n\n\n\n

Once the alias record is added and available<\/em>, go to the Overview\n<\/em>or Custom Domain <\/em>blade in the\nportal and click on + Custom domain<\/em>\nat the top of the screen.  This brings\nyou to the Add a custom domain<\/em>\nwindow.  Add a custom hostname to the Custom hostname<\/em> field.  This step validates external DNS.  If Azure can\u2019t resolve the new hostname to\nthe endpoint you will see an error like below.<\/p>\n\n\n\n

\"\"<\/a>
Add Alias Fail <\/figcaption><\/figure>\n\n\n\n

Once DSN is ready, a green check mark will show next to the\ncustom hostname.  Click Add <\/em>to add the custom hostname.<\/p>\n\n\n\n

\"\"<\/a>
Add Custom Hostname <\/figcaption><\/figure>\n\n\n\n

Once finished, the new hostname will resolve to the CDN\nendpoint. <\/p>\n\n\n\n

\"\"<\/a>
Custom URL Web Page <\/figcaption><\/figure>\n\n\n\n

The big red certificate error may have caught your\nattention.  There is a simple reason for\nthis.  Microsoft provides a valid certificate\nfor the azureedge.net domain.  I don\u2019t\n(yet) have a cert for the custom domain and have to accept the certificate\nwarning to access the page.<\/p>\n\n\n\n

What about HTTP and custom domains you may ask?  That\u2019s a good question. The CDN clearly\nindicates that HTTP and HTTPS are supported.<\/p>\n\n\n\n

\"\"<\/a>
HTTP and HTTPS Support <\/figcaption><\/figure>\n\n\n\n

However, when I try to access the custom URL with\nnon-encrypted HTTP (or azureedge.net for that matter) I get the message below\n\u201cThe account being accessed does not support HTTP.\u201d<\/p>\n\n\n\n

\"\"<\/a>
The Account Does Not Support HTTP <\/figcaption><\/figure>\n\n\n\n

The clue is the Account name in the error message.  The problem isn\u2019t the CDN, it\u2019s the storage\naccount.  Go to the Storage Account and\nopen the Configuration<\/em> blade.  Notice the option for Secure transfer required<\/em> is set to enabled.  This is the option forcing HTTPS.  If you want to use a custom hostname on the\nCDN without<\/strong> SSL, Secure transfer required<\/em> has to be\ndisabled on the storage account.<\/p>\n\n\n\n

\"\"<\/a>
Storage Account Secure Storage Required <\/figcaption><\/figure>\n\n\n\n

Speaking of SSL<\/h2>\n\n\n\n

This is the last section, I promise (well, last of part\n1).  Any serious webmaster will use SSL\nto deliver content.  Functioning SSL\nrequires a Certificate.  In this next\nsection, we are going to obtain and apply a web cert for the CDN.<\/p>\n\n\n\n

There are a couple of options to enable SSL.  The first, and more complicated, is to bring\nyour own certificate.  In this scenario,\nthe certificate is added to a Key Vault. \nOnce added, the CDN is granted access to the Key Vault and uses the cert\nto encrypt traffic.  This option is necessary\nif using your own certificates.  For this\nexample, I\u2019m going to use the free and easy option.<\/p>\n\n\n\n

The steps below use the  CDN managed certificate.  Microsoft uses Digicert to provision the\ncertificates.  This is a free, managed\noption available as part of the CDN service. \nDomain ownership is validated by the CNAME mapping added when\nconfiguring the custom domain.  <\/p>\n\n\n\n

There is one precaution you may want to consider before you\ngo to requesting the cert.  If Digicert\ncan\u2019t validate your domain for any reason, it will default to email for\nvalidation.  Digicert will email the\naddress listed in the WhoIs information on your domain.  Digicert will also email the addresses listed\nbelow to validate ownership.  Make sure\nyou have access to one of these addresses in the event CNAME validation fails.<\/p>\n\n\n\n