Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a web server running with two sites, I will call them and We have an SSL certificate installed on the site, that covers both and The test site does not have an SSL certificate.

When navigating to http:// we can successfully reach the test site. However, when navigating to https:// all traffic is redirected to https://, more or less without the user knowing. This could possibly confuse someone into thinking he's working on the test site, when in fact changes are made in production.

The server is running IIS 6. The test site does not have an SSL port configured. The only host headers are and for the two sites respectively.

How can I make sure https:// does not redirect to https://

share|improve this question
up vote 0 down vote accepted

You can use SSL Host Headers, even with an untrusted/non-SAN/non-Wildcard certificate.

share|improve this answer
Will setting as the only ssl host header make it refuse connections that are made to I would rather secure the test subdomain and give it its own ssl host header if I could, but I don't think the current certificate will allow it. – Tormod Jun 9 '11 at 14:12
Anything that doesn't have a host header will be a "catch all" - so just give the test subdomain site the host header, and the other one should get the lot. – TristanK Jun 9 '11 at 21:59

ssl sites can not be assigned using host headers because the headers are encrypted. An ssl site responds to the ip+port that it is on. So it is responding because they are on a shared IP, not because it is being redirected.

You need to either run the sites on seperate ips or add something to the logic of your site that redirects from https to http when it sees that someone is using the wrong url.

share|improve this answer

Are both sites using the same IP or not? If not, as soon as you tell the browser to use HTTPS, the server can't tell if you want or This is because, as James mentioned, the host headers are encrypted. So whichever site the SSL certificate is assigned to will be the one that responds. So the best thing to try would be to edit the metabase and explicitly add a host header to the port 443 binding of Basically this:

Then IIS won't respond when you go to with a valid website at all unless you eventually add an SSL cert to the site.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.