Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a 2 machine IIS 6 cluster (Windows 2003 Standard Edition) running a number of sites, only one of them has an SSL certificate. I have a number of IPs available to me on each machine, but the cluster is on a single IP.

I now want to have another site with its own SSL certificate running on the cluster.

What’s the best solution? I’ve thought of the following but I don’t know which one is best:

1) New cluster, under a different IP, this way I can identify the site by IP and don’t need to worry about SSL host headers. But, can a server be part of multiple clusters? Can Machine1 and Machine2 form both Cluster1 and Cluster2?

2) Configure SSL headers, I know it is possible, and did it long long ago.

3) Different port numbers. This isn’t really doable, as I need the sites to be on 443.

One by one:

1) If it is possible this seems like the best solution as I can keep my old cert and just get a new one for the site running under a diff IP.

2) This would mean that I have to get a new UC SSL certificate and give up my current certificate, correct?

I could do with some pointers guys, thanks in advance.

share|improve this question

2 Answers 2

To start to answer my own question, it seems like your certificate provider car add UCC support to existing certificates. I don't know if all providers do this, but mine certainly can!

Then you need to use SSL host headers, like so:

http://www.sslshopper.com/article-how-to-configure-ssl-host-headers-in-iis-6.html?jn5b47564a=3

I haven't tried it yet, but I think that's the solution.

share|improve this answer
    
That's definitely the cleanest solution. –  Robert Jan 20 '10 at 14:37

Not terribly familiar with the SSL Headers concept although the article looks interesting...

You should be able to add a second IP address to the existing cluster (don't need an additional cluster). Then you can configure IIS with the additional IP address and assign a new certificate to the new IP address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.