Aggregated Azure Blogs

How to: Add an HTTPS Endpoint to a Windows Azure Cloud Service

Cloudy in Seattle|http://blogs.msdn.com/jnak/default.aspx — Tue, 01 Dec 2009 20:50:00 Z

Back in May I posted about Adding an HTTPS Endpoint to a Windows Azure Cloud Service and with the November 2009 release of the Windows Azure Tools, that article is now obsolete.

In the last week I received a number of requests to post a new article about how to add HTTPS endpoints with the November 2009 release and later and I?m always happy to oblige!

To illustrate how to add an HTTPS endpoint to a Cloud Service, I?ll start with the thumbnail sample from the Windows Azure SDK ? the web role in that sample only has an http endpoint and I?ll walkthrough the steps to add an HTTPS endpoint to that web role.

Open the Windows Azure SDK folder, for me, that's C:\Program Files\Windows Azure SDK\v1.0 and unzip the samples-cs.zip file to a writeable location.

In the samples folder, there is a sample called ?Thumbnails?, open the solution Thumbnails.sln in Visual Studio. (2008 or 2010 will work)

Hit F5 to run the application and make sure everything works as expected.

If you aren?t familiar with this sample, it allows you to select an image locally via the web role which will upload that image to blob storage and will communicate the location to the worker via a queue. The worker will generate a thumbnail for that image and the web role displays the thumbnail.

The process to add an HTTPS endpoint is a 3 step process.

Configure the endpoint
Upload the certificate to the Cloud
Configure the SSL certificate (and then point the endpoint to that certificate)

Adding the HTTPS Endpoint

To configure the endpoint, open up the configuration UI on the WebRole by right clicking on the Thumbnails_WebRole node under the Roles node in the Solution Explorer and selecting ?Properties?.

Switch to the Endpoints tab and click the checkbox to select ?HTTPS?.

This will add the HTTPS endpoint but not specify the certificate.

Switch to the Configuration page and uncheck the Launch browser for: HTTP endpoint option, by unselecting this option, on run or debug of the cloud service, the default browser will only be launched for the HTTPS endpoint.

HTTPS Endpoints on the Local Development Fabric

Click on the Debug menu, Debug | Start Debugging to package and run the cloud service on the local development fabric.

The development simulation always uses a self-signed certificate issued to and issued by 127.0.0.1 which corresponds to the local host. This certificate is installed as part of the Windows Azure Tools + SDK.

This is an important thing to note as the certificate configuration I'm about to describe below only applies when the application is running on the cloud.

By default, this certificate is not root trusted and running an application with an https endpoint on the development fabric will result in a certificate error on the local development fabric. Click on ?Continue to this website (not recommended)? to browse to the web site:

For more information about the certificate Windows Azure installs including how to get rid of the certificate error when running on the development fabric -- see the end of this post.

The Certificate

To configure a certificate for use in the cloud, you will need a certificate which will be uploaded to the cloud and to configure that certificate for the role.

For the purpose of this article, we?ll create and use a self-signed certificate. Create a self-signed certificate by opening the IIS Manager.

Open the IIS Manager and select ?Server Certificates?.

Select ?Create Self-Signed Certificate?? under the ?Actions? heading on the far right of the dialog.

After creating the cert, click on ?Export?? to export the certificate to a pfx file. Provide a password you?ll remember.

The benefit of using IIS to create the certificate is that it is the easiest way I know to create a certificate that has the appropriate settings and an exportable private key.

Uploading the Certificate

We?ll now proceed with the upload step. Navigate the to Windows Azure Developer Portal and select a Hosted Service ? this will be the same Hosted Service that you will deploy your application to later.

On the Certificates heading at the bottom of that page, select ?Manage?.

This will bring you to the following page:

Upload the certificate by entering the name of the pfx file and the corresponding password you entered during the export step above and click ?upload?

Copy the certificate Thumbprint to your clipboard after it is installed to your Hosted Service Component.

Configuring the Certificate

Go back to the Visual Studio Thumbnails_WebRole configuration UI, click on the Certificates tab and click ?Add Certificate?.

Give the certificate a name (i.e. sslCert), paste in the Thumbprint in the Thumbprint field (you copied it to your clipboard after uploading the certificate to the portal) and leave the store location and name at the default of LocalMachine and My.

The certificates configuration page allows you to specify for a given role what certificates should be installed to the VM instances for that role and in which stores to install those certificates.

In this case, you are telling Windows Azure to install the certificate you uploaded via the Portal to all VM instances that are created for the Thumbnails_WebRole web role.

Switch to the Endpoints tab and select ?sslCert? for the HTTPS certificate.

Now deploy your application to the same Hosted Service in the Cloud where you uploaded the certificate.

Once the application is deployed, you will be able to access it via http and https. You can see from the screen shot below, the certificate I uploaded is being used for the https endpoint for the cloud service I deployed:

Note: Since we uploaded a self-signed certificate, your web browser will display a certificate error when browsing to your https endpoint, using a real signed certificate will solve this problem.

Also note that you may have to add intermediate certificates to complete the certificate chain. You can do this by uploading additional certificates via the Portal and configuring those certificates in the Certificates tab of the role configuration UI. (more on this in a subsequent post)

Known Issues:

If you forget to set the SSL certificate name for the HTTPS endpoint on the Endpoints page of the role configuration UI, you'll still be able to run on the local development fabric (as per above, it always uses the installed certificate) but when you publish, it will fail with an error in the error list:

No SSL certificate specified for https input endpoint 'HttpsIn' of role 'Thumbnails_WebRole'

Windows Explorer (and your default browser) will still come up and the Thumbnails.cspkg file will appear as a 0 byte file which is misleading. We will be fixing this in a future release such that it is more obvious that there was an error.

Specifying the SSL Certificate Used by the Development Fabric to be Trusted

To find the certificate that is installed by Windows Azure, run the Microsoft Management Console by typing ?mmc" from in the start menu.

Select ?Add/Remove Snap-in??:

And select ?Certificates?, ?Computer Account?:

Click ?Next? for ?Local Computer. then hit ?OK?.

Under Personal\Certificates, you will see the 127.0.01 certificate that was installed.

Because the certificate is not root trusted, it?s installed to the Personal store, when you run applications that have an SSL endpoint on the local development fabric, the web browser will come up with a certificate error indicating that ?There is a problem with this website?s security certificate?.

This is expected. Click on ?Continue to this website (not recommended)? to browse to the web site:

If you would like to make the certificate root trusted and therefore not see the Certificate errors, you can install the certificate to the ?Trusted Root Certification Authorities? Certificate store. Simply drag it to the ?Trusted Root Certification Authorities? folder in the mmc window. (you can also move it to the Current User TRCA store if you prefer)

To be on the safe side, please don?t trust any HTTPS web sites with any valued information on a machine where you have made this change.

Now if you made the 127.0.0.1 certificate root trusted, when you run the application, the web site will come up without the error:

Web Site Projects and Windows Azure

Cloudy in Seattle|http://blogs.msdn.com/jnak/default.aspx — Mon, 30 Nov 2009 19:00:00 Z

Currently (November 2009), the Windows Azure Tools for Visual Studio only support Web Application projects ? the type of Web projects that have a project file and are compiled.

For most folks, they reason to choose a Web Site project was for the ability to update it easily on the server and generally, the target customer for Windows Azure is typically using a Web Application project. (for a good article about the differences and when to use each one, please see this post)

Because Windows Azure has a deployment model where you can?t update the files on the server itself and considering the target customer, this seemed like a reasonable approach.

That said, there are a lot of apps out there that are in the Web Site format that folks want to deploy to Windows Azure and we?re figuring out the best way to support this moving forward.

For the time being, most folks are doing the conversion from Web Site to Web Application project and I wanted to point to a good post off the Visual Web Developer blog that will help make this easier: http://blogs.msdn.com/webdevtools/archive/2009/10/29/converting-a-web-site-project-to-a-web-application-project.aspx

Enhance the Diagnosability of your Apps with Windows Azure

Cloud Mouth » Windows Azure|http://www.cloudmouth.net — Wed, 25 Nov 2009 20:40:36 Z

In the last few posts, we have been discussing how running your application in Windows Azure allows you, with minimal incremental code, to cloud-enhance your application with capabilities such as elasticity, automation, and diagnostics. My colleague, Sumit Mehrotra, dives into the diagnostics capabilities on his blog ? describing how Windows Azure offers rich centralized diagnostic [...]

Windows Azure Walkthrough: Simple Logging

Sumit M's Blog|http://blogs.msdn.com/sumitm/default.aspx — Wed, 25 Nov 2009 18:32:57 Z

With Windows Azure Diagnostics, applications can perform logging using the familiar .Net Trace() APIs.

In this post we will create a new Cloud Service project using and look at the wiring that is done automatically to make Windows Azure Diagnostics, and specifically simple logging, work.

Simple Logging in a new Cloud Service project

1. Open Visual Studio as Administrator

2. Click on File | New | Project?

3. Select Visual C# | Cloud Service | Windows Azure Cloud Service

4. In the ?New Cloud Service Project? wizard select ?ASP.Net Web Role? and ?Worker Role? and click OK.

5. In Solution Explorer, expand the References in WebRole1. A reference to Microsoft.WindowsAzure.Diagnostics.dll has been added. This is the dll that exposes the diagnostics configuration and management APIs.

6. Open WebRole.cs in WebRole1 project.

7. A new using statement that has been added to this file

This brings in the Windows Azure Diagnostics name space into the role.

8. Going further down in WebRole.cs, the following line of code is found in WebRole.OnStart() method.

This line of code starts up the Diagnostic Monitor, mentioned in my earlier post. This is the component that runs along with the role and is responsible for the collection of diagnostic data on the node.

This line of code passes in the configuration setting name that is equal to the connection string for the storage account that Diagnostic Monitor needs to use to transfer the diagnostic data to.

NOTE: The configuration setting name can be any name that define in the *.cscfg file.

9. Open up ServiceDefinition.cscfg to see what the connection string looks like.

The default VS template sets up the connection string name as ?DiagnosticsConnectionString? and the value as ?UseDevelopmentStorage=true?. This particular connection string sets up Diagnostics Monitor to use Development Storage account.

The connection string can be changed to point to a cloud storage account as well as shown below

<Setting name="DiagnosticsConnectionString"

value="DefaultEndpointsProtocol=https;AccountName=<ACCOUNT_NAME>;AccountKey=<ACCOUNT_KEY>"/>

</ConfigurationSettings>

10. Step 5-9 are applicable for the worker role in the project as well.

11. Open Web.config in the Web Role project. The following following section has been added to web.config

This adds the Diagnostic Monitor Trace Listener to the role such that Trace() calls made in the application are collected by Diagnostic Monitor as well.

NOTE: The same section is added to the worker role?s app.config.

12. With Steps 5-11 all the wiring needed to generate and collect simple logs with Trace() APIs is done. In the current project, some sample TraceLine() calls that have already been added.

13. To illustrate the transfer of logs add the following lines in WebRole.cs file. We will delve deeper into the transfer mechanism in a subsequent post.

For now it is sufficient to know that this code sets up the configuration of simple logs such that they are automatically transferred every minute to the storage account that was configured in Step 9.

a. Add the following ?using? statements

b. Add the following lines to OnStart() method

public override bool OnStart()

{

//DiagnosticMonitor.Start("DiagnosticsConnectionString");

DiagnosticMonitorConfiguration dmc = DiagnosticMonitor.GetDefaultInitialConfiguration();

dmc.Logs.ScheduledTransferPeriod = TimeSpan.FromMinutes(1);

dmc.Logs.ScheduledTransferLogLevelFilter = LogLevel.Verbose;

DiagnosticMonitor.Start("DiagnosticsConnectionString", dmc);

}

c. Add the following method to the WebRole class

public override void Run()

{

int count = 0;

for (; ; )

{

count++;

Trace.WriteLine("Message: " + count, "Information");

Thread.Sleep(TimeSpan.FromSeconds(10));

}

14. Hit F5 to start debugging the project. The logs from the WebRole are shown in Development Fabric.

15. To see the collection of these logs in the storage account (Development Storage in this example), lets open up the account in a storage viewer tool. For this example we will use the Cloud Storage Studio tool from Cerebrata.

What?s next

We have looked at all wiring that has already been done to integrate Windows Azure Diagnostics in a cloud service project. We have also looked at how simple Windows Azure logs work. Next time we will explore more types of diagnostics data can be collected for the service, e.g. Performance Counters, Failed Request Logs, etc.

Run and Enhance Client-Server Apps with Windows Azure

Cloud Mouth » Windows Azure|http://www.cloudmouth.net — Wed, 25 Nov 2009 06:05:39 Z

In the previous post, we discussed that you can not only run some of your favorite technologies in Windows Azure but that you can easily cloud-enhance them with capabilities such as automation, elasticity, and diagnostics. My recent post on the official Windows Azure blog introduces an example, describing how to run a client-server application (e.g. a [...]

Add and Vote for Windows Azure Features

Cloudy in Seattle|http://blogs.msdn.com/jnak/default.aspx — Tue, 24 Nov 2009 20:07:00 Z

[Changing title to be more clear]

Mike Wickstrand, the director of Windows Azure product planning has put together a site where you can post and vote for Windows Azure ideas: http://www.mygreatwindowsazureidea.com

The idea came from the success we had with the Silverlight feature suggestions page and we hope to duplicate that success.

Please take the time to go to http://www.mygreatwindowsazureidea.com/ today submit your ideas and your votes - and don't forget about the areas that are my passion - the developer experiences and tools.

ASP.NET Provider Scripts for SQL Azure

Cloudy in Seattle|http://blogs.msdn.com/jnak/default.aspx — Tue, 24 Nov 2009 19:45:00 Z

If you want to use the ASP.NET Providers (membership, role, personalization, profile, web event provider) with SQL Azure, you'll need to use the the following scripts or aspnet-regAzure.exe tool to setup the database: http://support.microsoft.com/default.aspx/kb/2006191

Currently the only provider which is not supported on SQL Azure is the session state provider.

Personally, I like using SSMS 2008 R2 to connect to SQL Azure and using the Query window to run the scripts. (if you already have SSMS 2008 installed, you can use that as well, just connect from the Query window itself, not the Object Explorer as that will fail)

Note: I use SQL Server Authentication with the following credentials:

Server name: <servername>.database.windows.net
Login: <username>@<servername>)

Guy Shahine from the Windows Azure Dev Team!

David L's Blog|http://blogs.msdn.com/davidlem/default.aspx — Tue, 24 Nov 2009 02:44:28 Z

Guy has started blogging!

http://blogs.msdn.com/gshahine/

Go check out his first post, and stay tuned for more information from the belly of the beast!

Technorati Tags: Windows Azure,Dev Team

PDC 2009 Windows Azure Resources

Extemporaneous Mumblings|http://dunnry.com/blog/ — Mon, 23 Nov 2009 17:51:28 Z

For those of you that made PDC, this will serve as a reminder and for those of you that missed PDC this year (too bad!), this will serve as a guide to some great content.

PDC Sessions for the Windows Azure Platform

Getting Started

Windows Azure

Codename "Dallas"

Enrich your Applications with Data from Microsoft Project Code Name "Dallas"

SQL Azure

Identity

Customer & Partner Showcases

Channel 9 Learning Centers

Coinciding with PDC, we have released the first wave of learning content on Channel 9. The new Ch9 learning centers features content for both the Windows Azure Platform, as well as a course specifically designed for the Identity Developer. The content on both these sites will be continued to be developed by the team over the coming weeks and months. Watch out for updates and additions.

Downloadable Training Kits

To complement the learning centers on Ch9, we still continue to maintain the training kits on the Microsoft download center, which allows you to download and consume the content offline. You can download the Windows Azure Platform training kit here, and the Identity training kit here. The next update is planned for mid-December.

My PDC09 Talk, and Takeaways about Cloud-Enhancing Your Apps

Cloud Mouth » Windows Azure|http://www.cloudmouth.net — Sat, 21 Nov 2009 05:03:45 Z

I, along with Tushar Shanbhag, recently gave a talk @ PDC09 on using PHP, memcached, and MySQL to build applications with Windows Azure. The video and slides are now available.? We used the technologies in the talk to reinforce some key Windows Azure benefits, specifically how to: Easily get started with these (PHP and memcached/MySQL) [...]