Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm looking to offer our online services over https and I'm having a couple of problems understanding how to accomplish this. To access our services you must pass through our ISA firewall to a Win2000 server running IIS6. About half our services are located here and the other half take you to a Win2003 server also running IIS6. So, in order to achieve this must each server have the proper certificate installed? ISA, IIS6_1 and IIS6_2? Is there a separate configuration that must be made to our ISA firewall?

The other problem is with the CA and knowing how many certificates I need. It's important to note that the domain name for our services on IIS6_1 is www.domainname.com but the domain name on IIS6_2 is services.domainname.com. I believe that this will require me to purchase more than one certificate. It looks as though we will be going with Thawte's SSL123 as it's a good name and it's fast to get. Will I need to purchase 2 certificates (one for www that will be installed on our ISA firewall as well as IIS6_1, and one for services.domainname.com on IIS6_2)? Or will I need to purchase 3, the extra one being used on our firewall server?

Another side question is about SAN's (subject alternative names). Is this basically adding sub-domains to your cert? So I could purchase one cert with 1 SAN for my www and services.?

Thanks a lot for your help! Please let me know if I can provide any further information.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You should probably purchase the 'wildcard' certificate for domainname.com This will allow you to issue valid certificates yourself for subdomains underneath domain.com (e.g. both the ones you mentioned).

The wildcard certs are more expensive than individual certs, but allow you greater flexibility in future.

As for the specific cert mappings, you'll need to load the certs for each particular web page onto the host that serves that page, and also into the ISA server's web publishing rules (the dialogs for certs are in the 'listener' objects).

SAN is a different thing in this context. They're used to add multiple different domain names to a single certificate e.g. add both mydomainname.com and myoldcompanyname.com under a single cert. Not as useful as a wildcard which gives you coverage of *.mydomainname.com

share|improve this answer
A wildcard certificate is only needed if you're operating on different subdomains. If all the servers are loadbalanced on the same domain name (CN) then you're going to face the same issue of having a certificate loaded for each one. The OP doesn't state whether or not they are though. –  Mark Henderson Mar 23 '10 at 22:24
Second paragraph ;) –  Chris Thorpe Mar 23 '10 at 23:13
2nd paragraph actually says The wildcard certs are more expensive than individual certs... - anyhow the point of my comment was actually about the specific need for the wildcard, not loading them. Mind you op doesn't state if they all run on the same domain or not. –  Mark Henderson Mar 23 '10 at 23:17
His second paragraph. Yes he does. –  Chris Thorpe Mar 24 '10 at 1:10
He doesn't mention load balancing though: without multiple public IP addresses, he won't be able to host more than SSL site on 443. –  gravyface Mar 24 '10 at 1:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.