Mapping of URLs to Azure WebRoles

I cannot find any high level discussion docs that describe how URLs are mapped to Azure WebRoles in the case where an application has multiple WebRoles.

Is it:

roleA.myApp.com to WebRoleA
roleB.myApp.com to WebRoleB

or:

www.myApp.com/roleA to WebRoleA
www.myApp.com/roleB to WebRoleB

The answer to this question will help me decide what type of SSL certificate(s) my Azure application will need.

Note: I understand a WebRole can have a configured number of instances, but in this question I am discussing different WebRoles within an app.

Each web role gets its own port as its endpoint differentiator. Typically you'd hit port 80 (or 443). You'll need to choose non-standard ports for the 2nd webrole.

Here's what the configuration form looks like in VS2010, when configuring a webrole. I simply added two web roles, and chose the 2nd one. I can now specify the port as well as the certificate, for the specific webrole.