3

I have written an ASP.NET MVC application that allows the user to specify their own custom domain. I have IIS configured to send all requests to the default website so I do not need to use host headers. Everything works perfectly. The only problem is SSL.

I know this question has been asked multiple times in many forums but the answers generally conflict or speak in absolutes like (this cannot be done). That's not really an option for me. What I'm looking for here are some options; I'm open to unconventional :).

I have seen some constructive responses that suggest using ISA server as an SSL proxy. Does anyone know more about this? Or has anyone configured this and had success?

Basically I want to provide the my users a way to request a CSR from the application, go purchase and download an SSL certficate, come back to my application and upload the certificate issued by an authorized certification company.

I'd like to do this without having to provide separate IP addresses to clients that want to use a custom domain and ssl on their site. This is simply because my application is hosted on the Amazon cloud and they're not keen on giving me a big block of IP addresses.

My application can be hostd on IIS6 or IIS7.

SOLUTION: Thanks for all your help on this guys. I certainly didn't understand this problem as well as I do now. I think my solution for now will be to generate a wildcard certificate and force my clients to use clientname.someshareddomain.com if they want a secured connection. For clients that simply aren't OK with that, I will probably provision another elastic IP address via api call to amazon web services, create a new website in IIS and point it at my application's root folder, and then programatically generate a CSR from that new site. I'm just going to have to work out some kind of deal with Amazon to give me a decent block of IP addresses.

3 Answers 3

10

I'm very sorry that you do not like the answer "you cannot do this" but you cannot do what you want to do. The technology just doesn't allow this to work the way you want.

Here's why.

The HTTP protocol allows more than one server to share an IP address. It does this via the HTTP/1.1 Host header:

Host: servername.example.com

SSL handshake happens before the HTTP handshake happens. This means the server has no idea what certificate to present to the client based upon what server the client wants.

So, try as hard as you want, but multiple certificates cannot be used on a single IP address. No matter how hard you try, nor how much this isn't an option for you.

5
  • Is this an IIS thing or a technology thing. I know of an other application that is currently doing what I need to do. Zendesk.com allows you to enter your own domain like support.mydomain.com and then generate a CSR. Pinged support.zendesk.com (their product support portal) and then pinged my custom domain at support.mydomain.com... they both have the same IP. How do you think they are doing this? When you say the technology doesn't support this; are you talking about IIS? Would this work with Linux and OpenSSL? Jan 19, 2010 at 23:38
  • support.zendesk.com => 67.219.156.39; support.mydomain.com => 216.34.94.184; perhaps you'd like to talk in real names, not hypotheticals.
    – womble
    Jan 19, 2010 at 23:44
  • support.zendesk.com/forums/3199/entries/13976 Read the part just after the first numbered list that says SSL and IP sharing doesn't work. Once again, I'm sorry this isn't what you want to hear, but it's truth. We're not lying to you, it just cannot work. You CAN have a SINGLE CERTIFICATE with more than one hostname on it, and this will work, but you cannot have multiple certificates on a single IP address. Jan 19, 2010 at 23:45
  • You can have a wildcard certificate that covers *.zendesk.com, but I've never, ever, ever seen multiple SSL's on one IP. And we run about 20 SSL enabled services, so if there was a way, I would be using it! Jan 20, 2010 at 1:12
  • Good answer btw. Perfectly to the point and helped me too :)
    – Amadiere
    Feb 10, 2010 at 11:03
2

As Michael said, if something is impossible, stamping your foot and pouting doesn't change things.

Putting separate SSL certificates on separate IP addresses isn't a problem, technologically speaking; it's just a provisioning issue (which is a Simple Matter of Programming), and having a network provider who understands the needs of larger-scale companies and is willing to pre-allocate a decent-sized block of addresses for SSL domains.

However, there is another option, known as "Server Name Indication", whereby the browser can tell the server what vhost it wants to talk to at SSL negotiation time, so the server can present the correct certificate. Unfortunately, support for this isn't universal; according to the above Wikipedia page, neither IIS 6 nor 7 can handle it on the server side, and you need to be running Vista to use it with IE on the client side (Firefox, Opera, and Chrome have all supported it for a while).

So, if you're willing to switch to a decent web server, and alienate whatever portion of your userbase is still using outdated browsers on older Microsoft OSes, then you can use that. Nobody seems to want to annoy Aunt Tillie running IE 5.5 on Windows 98, though...

3
  • Thanks for your post. I'm not stamping my foot exactly, I just wanted some constructive options to be presented as you have above. I am hosting my application on the Amazon cloud, so I could provision more public IP addresses with api calls. Problem is, Amazon will only let me use so many of those. Server Name Indication seems promising, but isn't supported in IIS yet and there is the compatibility issue. Thanks for your help. The real name above for the Zendesk example is support.jadalabs.com => 67.219.156.39 Jan 20, 2010 at 5:26
  • You'll note that the certificate presented by support.jadalabs.com isn't a valid one for that name, so Zendesk isn't really doing what you're trying to do (or, if you don't mind SSL cert failures, I guess you could stick a self-signed global wildcard cert in place...)
    – womble
    Jan 20, 2010 at 6:01
  • Oh, and if Amazon won't give you the IP addresses you need, go find another vendor who will. I know of people who have a lot of SSL sites running on EC2, though, so you probably just need to wade through the hell that is AWS support and explain your situation.
    – womble
    Jan 20, 2010 at 6:04
0

If the issue is about providing for secure sessions (and not about each customer owning their own certificate) why not take the burden and complexity out of the picture by using a wildcard SSL certificate?

4
  • If you can point to a widely-trusted SSL provider that's giving out global wildcard certs, I'm sure you'd have a lot of very happy sysadmins...
    – womble
    Jan 20, 2010 at 6:02
  • What I meant is to use a wildcard cert so that the OP could provide for customerA.domain.com, customerB.domain.com, etc. It's not an exact solution to the problem but it would work.
    – joeqwerty
    Jan 20, 2010 at 12:13
  • That would make a lot of happy admins, and a lot of scared security types. Jan 20, 2010 at 15:33
  • What would? My original answer or my comment? I should have elaborated on my answer when I originally posted it. What I meant was for the OP to change his thinking slightly and architect his solution to use a wildcard SSL cert and provide URL's to his customers such as customerA.OPdomain.com, customerB.OPdomain.com., which would work, no?
    – joeqwerty
    Jan 20, 2010 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .