up vote 0 down vote favorite
share [g+] share [fb]

I am trying to setup 2 completely separate IIS sites on a single server (single IP address) that will both use different DNS entries but the same port (443) to access the site over SSL. For example,

Site 1: www.application.subdomain.domain1.uk

Site 2: www.application.subdomain.domain2.uk

We already have certificates for each of the above sites and I can't seem to get this to work.

I am running Server 2008 with IIS7 and but the host header property is greyed out in IIS so I can't add this in.

Is this possible to achieve? I might be missing something very simple here but just can't see it.

link|improve this question
feedback

3 Answers

up vote 3 down vote accepted

To my knowlege not possible due to security constraints - you need two ip addresses. IIS tries to fowward the request to the proper sub-instance BEFORE decoding it, and it can thus not evaluate the host header via https.

So, for SSL you need multiple ip addresses.

link|improve this answer
Of course! I hadn't thought that it might need to view the encrypted request to determine the host header and thus which cert. So if I got a second public IP I would be able to do it? – Penfold Oct 28 '10 at 10:34
Yes. Works like a charm then. Just make sure you bind to ONE ip address, not all ;) – TomTom Oct 28 '10 at 10:39
I have now configured the server like this (2 NICs, each with a different IP address) but I am unable to access the server through the second IP address, even on the server itself! Any ideas? – Penfold Oct 29 '10 at 10:55
Hm, do it right? As in: without any more info this is about the only answer I can give. Open a new question, provide full network inforamtion and I am sure we find the issue fast. – TomTom Oct 29 '10 at 11:13
1  
Unless I am mistaken, you don't actually need an additional NIC to get this to work. You should be able to add an IP to an existing NIC and bind your site to that IP through IIS and get SSL working using TomTom's suggestion. TomTom is right though, best bet is to open a new question for the networking issue. – tcnolan Oct 29 '10 at 21:42
show 1 more comment
feedback
up vote 2 down vote

You currently have to have one IP address per certificate but your situation would allow you to use a single SAN certificate that contains both names. Once you install that, you would just need to set up SSL Host Headers: http://www.sslshopper.com/article-ssl-host-headers-in-iis-7.html

link|improve this answer
This would definitely be the right way to go, why have the two separate certificates/IPs for subsites when you could use a single certificate for both and make the whole installation easier? – Charles Oct 28 '10 at 20:08
I would like to go down the route of a wildcard SSL certificate but its just not a possibility due to our customers restrictions. Each of their domains are totally different, as in no common denominator! :( The exact examples that I used in the question were a little misleading I suppose. – Penfold Oct 29 '10 at 12:54
If you have names on completely different domains, you can still put them all in a single certificate by getting a SAN certificate (also sometimes called a Unified cOmmunications certificate). – Robert Oct 30 '10 at 2:10
feedback
up vote 0 down vote

According to recent announcements, IIS8 will support what you are looking to do.

http://blogs.iis.net/wonyoo/archive/2012/03/01/iis-8-0-platform-features-for-web-hosters-and-service-providers.aspx

IIS 8.0 support Server Name Indication (SNI), which has extended TLS to include the virtual domain name to be passed from the client at the time of "SSL Hello". This effectively allows IIS 8.0 to enable "hostname binding" for SSL sites, which eliminates the need for having a dedicated IPv4 address per SSL site.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.