Multiple SSL certificates on IIS 6 cluster

Question

I have a 2 machine IIS 6 cluster (Windows 2003 Standard Edition) running a number of sites, only one of them has an SSL certificate. I have a number of IPs available to me on each machine, but the cluster is on a single IP.

I now want to have another site with its own SSL certificate running on the cluster.

What’s the best solution? I’ve thought of the following but I don’t know which one is best:

1) New cluster, under a different IP, this way I can identify the site by IP and don’t need to worry about SSL host headers. But, can a server be part of multiple clusters? Can Machine1 and Machine2 form both Cluster1 and Cluster2?

2) Configure SSL headers, I know it is possible, and did it long long ago.

3) Different port numbers. This isn’t really doable, as I need the sites to be on 443.

One by one:

1) If it is possible this seems like the best solution as I can keep my old cert and just get a new one for the site running under a diff IP.

2) This would mean that I have to get a new UC SSL certificate and give up my current certificate, correct?

I could do with some pointers guys, thanks in advance.

Answer 1

To start to answer my own question, it seems like your certificate provider car add UCC support to existing certificates. I don't know if all providers do this, but mine certainly can!

Then you need to use SSL host headers, like so:

http://www.sslshopper.com/article-how-to-configure-ssl-host-headers-in-iis-6.html?jn5b47564a=3

I haven't tried it yet, but I think that's the solution.

Answer 2

Not terribly familiar with the SSL Headers concept although the article looks interesting...

You should be able to add a second IP address to the existing cluster (don't need an additional cluster). Then you can configure IIS with the additional IP address and assign a new certificate to the new IP address.