Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to apply a certificate to one of my sites on IIS. At the moment, I use a single IP address and use host-headers, to give them friendly names. Can I do this for my SSL site or do I have to use the server name?

share|improve this question

migrated from Mar 26 '11 at 10:21

This question came from our site for professional and enthusiast programmers.

If each hostname is a subdomain of a single base domain (,, you can use a wildcard certificate with SSL Host Headers. If they are different ( and, you can use a Unified Communications certificate. See for how to set up SSL Host Headers in IIS.

share|improve this answer

Strictly speaking, you do not have to use a wildcard certificate (and many CAs would refuse to issue one), you could use a certificate with all your friendly host names listed in subjectAltName extension of the certificate. This way you could use one certificate for all your host names and avoid wildcard certificates. Anyway, HTTPS RFC recommends checking host name against subjectAltName if it is present, and not against certificate's subject.

Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.

share|improve this answer

So long as your certificate has a wildcard in it.

share|improve this answer
Okay, thanks for the reply. – serialhobbyist Oct 20 '09 at 13:50

Yes, you can use a Name-based virtual hosting, but with some fairly strong provisos

  1. If you want to embrace the bleeding edge and don't care about support for old browsers, you can use Server Name Indication (SNI) (if supported by your web server and clients). This means that the client will inform the server (when its first starting to talk about SSL) which name it believes it should be talking to.

  2. If your list of sites doesn't change much, and you can't afford to rely on SNI, then you can use a SAN (Subject Alternate Name) certificate that matches multiple names. The names don't even to have any any common domain. (Have a look at the certificate for and you'll see a lot of names listed)

  3. If you want to have a lot of names (perhaps dynamically generated), then a wildcard certificate ("*", which would match anything under * There are limitations to that though.

  4. Otherwise, you need to have different IP addresses, and create suitable bindings in your webserver config to say that IP_x uses Certificate_x, which chews through public addresses and is the thing of last resort really.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.