title: Azure Traffic Manager SSL Setup (not classic)
body: <p>I have an Azure API App Service that I want to configure "priority" traffic management for (this is the new Traffic Manager, not classic).  I have deployed the service to two separate Azure regions and configured a Traffic Manager instance to perform priority routing to the two service instances.  The services have the following custom domain configurations:</p>
  
  <p>foo1.mydomain.com</p>
  
  <p>foo2.mydomain.com</p>
  
  <p>I have A records for both subdomains pointing at the respective Azure App Service IP addresses.</p>
  
  <p>I have also attached a wildcard cert to the services and everything works nicely if I navigate to <a href="https://foo1.mydomain.com" rel="noreferrer">https://foo1.mydomain.com</a> or <a href="https://foo2.mydomain.com" rel="noreferrer">https://foo2.mydomain.com</a>.  Traffic manager endpoint monitoring shows both endpoints as being online and enabled.</p>
  
  <p>Now, I want to have clients make requests to a vanity endpoint: foo.mydomain.com, which I have created a CNAME for.  The CNAME is pointed at the traffic manager instance URL myapi.trafficmanager.net.  </p>
  
  <p>When I attempt to resolve the vanity URL using SSL/TLS, i.e., <a href="https://foo.mydomain.com" rel="noreferrer">https://foo.mydomain.com</a>, I get a certificate error, because traffic manager is attaching an *.azurewebsited.net certificate.  If I attempt to resolve the vanity URL without SSL/TLS, i.e., <a href="http://foo.mydomain.com" rel="noreferrer">http://foo.mydomain.com</a>, I receive a 404 and "Web app not found" message.  Again, resolving the individual endpoints explicitly returns a 200 as expected.</p>
  
  <p>My question: How do I properly configure Azure Traffic Manager to do priority routing for two custom domain names using my SSL/TLS cert and a vanity URL?</p>
  
  <p><strong>Dig output for reference:</strong></p>
  
  <pre><code>my-machine:~ jtw$ dig foo.mydomain.com
  
  ; &lt;&lt;&gt;&gt; DiG 9.8.3-P1 &lt;&lt;&gt;&gt; foo.mydomain.com
  ;; global options: +cmd
  ;; Got answer:
  ;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 4088
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
  
  ;; QUESTION SECTION:
  ;foo.mydomain.com.      IN  A
  
  ;; ANSWER SECTION:
  foo.mydomain.com.   299 IN  CNAME   myapi.trafficmanager.net.
  myapi.trafficmanager.net. 299 IN    CNAME   foo1.mydomain.com.
  foo1.mydomain.com.  299 IN  A   192.168.1.1 //the actual IP of my first priority endpoint is returned here
  
  ;; Query time: 369 msec
  ;; SERVER: 8.8.8.8#53(8.8.8.8)
  ;; WHEN: Sun Jul  3 11:13:59 2016
  ;; MSG SIZE  rcvd: 112
  </code></pre>