Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two Server but just one IP and the need to run on both a Site under the port 443.

I've found out that it is also possible to run multiple SSL web sites on 443 using a shared IP address by making use of Host Headers, however this requires a Wildcard Certificate and a metabase configuration change. But that sounds really bad so I would prefer to use any other solution.

I don't know if it is important that the Domain (certificate) mysub.domain.com is verified by verisign

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The SSL negotiation, including the browser analyzing the Common Name field of the certificate to compare against the host it attempted to connect to, occur long before the server has a chance to see a request. Because of this the server cannot deliver a certificate based upon the Host: head in the request. A wildcard certificate resolves this only because the same certificate is used for each hosted site.

For example if you have a *.example.com cert and you use it to host (based on Host header):

blog.example.com
www.example.com

In each case the certificate is valid for the site hosted and the browser will be happy.

share|improve this answer
    
This is not correct, as server name indication was created specifically to address this limitation. –  Razor May 18 '11 at 15:42
    
thanks for that information. But I only care for the certificate on one of the Server. The other is just a sort of demo an not yet attached. I hope I don't get you wrong, but you also say there is no way to this (ignoring the wildcardcertificate)? –  sra May 18 '11 at 15:43
    
Razor: Unfortunately adoption isn't high enough for the TLS SNI methods just yet. Most sites don't want to exclude the collection of unsupported browsers just yet. Hopefully soon... –  Kyle Smith May 18 '11 at 19:21
2  
sra: You could serve the existing certificate for both sites and use a host-based configuration but you'll have to override every single security warning your browser throws up and it tells you you're visiting the worlds worst web page. –  Kyle Smith May 18 '11 at 19:22

It is possible to handle different domains with different certificates correctly over the same IP/port, thanks to server name indication.
However, this only works with recent browsers (IE8/winXP does not support it), which means that unless you can afford to not support them, you really need to add either IP or ports.

share|improve this answer
    
thanks for that additional information but I can't do this :( –  sra May 18 '11 at 15:47
    
@Kyle Can't I identify the site over a foldername (mysub.mydomain.com/folder/) and fetch the request from the other server? –  sra May 18 '11 at 15:50
    
Sure you can, sra, if you set up a proxy for /folder/ to deliver the content from the second site. I don't know how to do this in IIS, however. –  Kyle Smith May 18 '11 at 19:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.