Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a hosting server (Windows Server 2008 + IIS7) where I'm hosting tens of sites... some of them need to be secured with SSL.

For now I've opened a new IP and certificate for each such site - but as more and more sites need HTTPS, I'm looking for a better solution.

Any ideas how I can use a server certificate for all the site? or some other solutions?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The issue is that the SSL negotiation happens before the HTTP header is transmitted. This means that, at the time the server needs to pick a certificate and key pair for certifying its authority, the only information it has about what host the client is attempting to reach is the IP address.

There is no viable solution around this problem for IIS 7. In IIS 8, you'll be able to use Server Name Indication (an extension to TLS) to work around it but even then it will only work with newest clients.

(http://en.wikipedia.org/wiki/Server_Name_Indication)

share|improve this answer
    
Thanks :) bad news, but very helpful. –  roman Nov 3 '11 at 10:19
    
+1 for a good answer! –  simonlchilds Nov 3 '11 at 15:33

One option is the Server Name Indication which Stephane mentioned.

Another options is UCC (aka SAN) certificates (see this explanation). Surprisingly, on GoDaddy SSL plans you can have get up to 100 domains in one certificate.

But probably you can obtain such certificates only if you own the domains for all the sites you host.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.