# Workloads
import DocButton from '~/components/webkit/DocButton.vue';
import Apiv4Rollout from '~/includes/snippets/apiv4Rollout/en/snippet.mdx'
:::note
This page documents the new Workloads product. If your account hasn't been migrated yet, refer to the [legacy Domains reference](/en/documentation/products/build/applications/domains/).
:::
**Workloads** is an [Azion Console](https://console.azion.com) feature that centralizes communication protocol settings, such as certificates, domains, ports and protocols.
If you already own an application address with an existing domain such as `www.azion.com`, you can [redirect your traffic to Azion](/en/documentation/products/guides/point-domain-to-azion/) by configuring the records in your DNS provider and listing your **custom domains**.
You may also bind a **Digital Certificate** to your workload to enable HTTPS/TLS security encryption.
## Implementation
| Scope | Resource |
| --- | --- |
| Adding a custom domain | [Getting started](/en/documentation/products/guides/configure-a-domain/) |
| About Certificate Manager | [Certificate Manager](/en/documentation/products/secure/firewall/certificate-manager/) |
| About mTLS | [mTLS](/en/documentation/products/secure/firewall/mtls/) |
---
## Infrastructure
With this setting you can control where your configuration will be deployed while using the same hostname in order to create an production and staging environments that can fully deliver `SSL/HTTPS` capabilities by adjusting your local DNS resolution and, therefore, test your application without worring about CORS, certification validation and other hostname related aspects.
- **Production**: production environment of the application. The Azion domain will be in the format `xxxx.map.azionedge.net`.
- **Staging**: environment for testing the application. This configuration won't impact the **Production** environment. The Azion domain will be in the format `xxxx.preview.azionedge.net`.
Select the infrastructure type for your workload. Once this option is saved, it cannot be modified.
:::tip
The local `etc/hosts` file maps IP addresses to domains. When you [associate the edge node IP with the CNAME](/en/documentation/products/guides/stage-applications-through-hosts-file/) assigned to your domain in your `hosts` file, you force your computer's DNS resolution to access this domain through the edge node and not through public DNS servers. This way, you can stage your application locally as if it were already deployed on your custom domain on the edge before you [point your domain](/en/documentation/products/guides/point-domain-to-azion/) to Azion.
:::
---
## Domains
Manage the addresses that users can use to access your application. Ensure proper DNS configuration by mapping CNAME records to the workload domain. You can also use [Edge DNS](/en/documentation/products/secure/edge-dns/) to simplify domain management and link your domains to Azion.
### Workload Domain
A Workload domain will be generated upon creating a Workload.
You may allow access to the self-generated workload domain after creating a workload (such as `xxxxx.map.azionedge.net`) by enabling the `Workload Domain Allow Access switch`, independently of other domains configured for this Workload.
### Azion Custom Domain
`Azion Custom Domain` lets you set up a custom domain for your application using the format `example.azion.app` to personalize your application address with a user-friendly URL. These names are limited and not shareable among multiple accounts or configurations, and are automatically HTTPS enabled by using Azion's SAN certificate. This feature is available at no additional cost.
---
## Deployment Settings
Configure your workload deployment by selecting an [Application](/en/documentation/products/build/applications/) and an [Firewall](/en/documentation/products/secure/firewall/). You can also set up [Custom Pages](/en/documentation/products/secure/custom-pages/) to handle errors and configure cache time-to-live (TTL) settings based on the HTTP status code returned from the edge connectors.
A Workload Deployment is a configuration that ties **Application** (mandatory), **Firewall** and **Custom Pages** together for your application.
---
## Protocol Settings
Configure the communication protocols used between the workload and its users. This section allows you to define security, compatibility, and performance settings to optimize how your Workload operates at the edge.
- **HTTP**: delivers your application using only the HTTP protocol.
- **HTTP and HTTPS**: delivers your application using both the HTTP and HTTPS protocols.
:::note
If you choose to deliver your application through HTTP and HTTPS, you must set up a [digital certificate](/en/documentation/products/secure/firewall/certificate-manager/) to your domain.
:::
#### HTTP/3 support
Enable `HTTP/3` support. Based on the QUIC protocol standard, `HTTP/3` provides faster load times and lower latency when compared to previous versions.
For `HTTP/3` enabled Workloads, Azion will listen to `443/UDP` port which is the default and common used port for most browsers and `HTTP/3`compatible clients.
Upon a user's first request to an application with `HTTP/3`, the handshake and first response will be conducted using `TCP` and `HTTP/1.1` or `HTTP/2`. The response from this exchange will assign a value to the [Alt-Svc header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Alt-Svc) that indicates that the latest version of the protocol is available to the browser. If the browser supports HTTP/3, the QUIC protocol and HTTP/3 will be used, unless the cached response is missing or expires.
### Ports
Azion offers a simultaneous multiport solution, allowing you to customize through which HTTP and HTTPS ports your application will be delivered through. You must choose *at least one port* for each protocol, but you can select from all available ports for delivery.
#### Available ports
The following table lists all available ports for HTTP, HTTPS, and HTTP/3 (QUIC) protocols. The "Notes" column indicates the default port for each protocol.
| Port | Protocol | Notes |
|---------|--------------|----------|
| 80 | HTTP | default |
| 8008 | HTTP | |
| 8080 | HTTP | |
| 8880 | HTTP | |
| 443 | HTTPS | default |
| 8443 | HTTPS | |
| 9440 | HTTPS | |
| 9441 | HTTPS | |
| 9442 | HTTPS | |
| 9443 | HTTPS | |
| 7777 | HTTPS | |
| 8888 | HTTPS | |
| 9553 | HTTPS | |
| 9653 | HTTPS | |
| 8035 | HTTPS | |
| 8090 | HTTPS | |
| UDP/443 | HTTP/3 (QUIC)| default |
### Minimum TLS version
The **Transport Layer Security (TLS)** protocol allows you to encrypt web traffic. The following TLS versions can be used with applications:
- TLS 1.0 (*deprecated*)
- TLS 1.1 (*deprecated*)
- TLS 1.2
- TLS 1.3
You can choose the minimum version of TLS that'll be supported by your Workload. By choosing recent versions of the protocol, older devices or browsers might not be able to access the application.
Azion blocks TLS Renegotiation and TLS Resumption by default. If you want to customize this setup, [contact the Sales team](https://www.azion.com/en/contact/).
### TLS Ciphers
Ciphers are cryptography algorithms utilized to encrypt *plaintext* into *ciphertext*, which requires a key to be decrypted. Azion gives you the possibility to change the *cipher suite* your application will use in order to protect your application against TLS attacks.
The cipher suite will determine which cryptographic algorithms will be used in the TLS connections of your application. Both client and server will *negotiate* the cipher suite to securely encrypt and decrypt the data exchanged during the session.
The table below shows the ciphers available in each cipher suite.
| Cipher | TLSv1.2_2018 | TLSv1.2_2019 | TLSv1.2_2021 | TLSv1.3_2022 |
|----------------------------------|:------------:|:------------:|:------------:|:------------:|
| TLS_AES_128_GCM_SHA256 | ✔︎ | ✔︎ | ✔︎ | ✕ |
| TLS_AES_256_GCM_SHA384 | ✔︎ | ✔︎ | ✔︎ | ✕ |
| TLS_CHACHA20_POLY1305_SHA256 | ✔︎ | ✔︎ | ✔︎ | ✕ |
| ECDHE-ECDSA-AES128-GCM-SHA256 | ✔︎ | ✔︎ | ✔︎ | ✔︎ |
| ECDHE-ECDSA-AES256-GCM-SHA384 | ✔︎ | ✔︎ | ✔︎ | ✔︎ |
| ECDHE-ECDSA-CHACHA20-POLY1305 | ✔︎ | ✔︎ | ✔︎ | ✔︎ |
| ECDHE-ECDSA-AES256-SHA384 | ✔︎ | ✔︎ | ✕ | ✕ |
| ECDHE-ECDSA-AES128-SHA256 | ✔︎ | ✔︎ | ✕ | ✕ |
| ECDHE-RSA-AES128-GCM-SHA256 | ✔︎ | ✔︎ | ✔︎ | ✔︎ |
| ECDHE-RSA-AES256-GCM-SHA384 | ✔︎ | ✔︎ | ✔︎ | ✔︎ |
| ECDHE-RSA-CHACHA20-POLY1305 | ✔︎ | ✔︎ | ✔︎ | ✔︎ |
| ECDHE-RSA-AES128-SHA256 | ✔︎ | ✔︎ | ✕ | ✕ |
| ECDHE-RSA-AES256-SHA384 | ✔︎ | ✔︎ | ✕ | ✕ |
| AES128-GCM-SHA256 | ✔︎ | ✕ | ✕ | ✕ |
| AES256-GCM-SHA384 | ✔︎ | ✕ | ✕ | ✕ |
| AES128-SHA256 | ✔︎ | ✕ | ✕ | ✕ |
---
## Mutual Authentication Settings
Enable Mutual Authentication (mTLS) to require that both client and server present an authentication protocol to each other.
Azion Workloads also have **Support for Mutual Transport Layer Security (mTLS)**, an authentication method for users and visitors that validates the digital certificate on both sides of a request, client, and edge (server). Adding support for mTLS to your **Application** ensures a more secure *TLS/TLS handshake*.
:::tip
You may need mTLS if your Workload deals with financial services and payments.
:::
To enable this feature, contact our [Sales Team](https://www.azion.com/en/contact/).
---
## Digital Certificate
To use your Workload with HTTPS support, you'll need a TLS certificate (X.509). Without additional costs, you may include your TLS certificates in [Azion Console](https://console.azion.com) or generate a *Let's Encrypt*™ certificate, which will be automatically managed by Azion.
---
## Limits
These are the **default limits**:
| Scope | Limit |
| --- | --- |
| CNAMEs per Workload | 50 |
These are the **default limits** for each Support service:
| Scope | Developer | Business | Enterprise | Mission-Critical |
| --- | --- | --- | --- | ---|
| Workload per account | 100 | 100 | 100 | 1,000 |