Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My team has been asked to add a new feature to a project we're working on, and none of can find authoritative details on whether it's possible with Windows/IIS.

The short of it is that we're hoping to have customers update their DNS with a CNAME record to point their website to our server instead of theirs (they why's are trivial - it's what the app does on behalf of your site).

We're using a reverse proxy with several custom modules to serve particular content from the original servers. So far everything works perfectly until we encounter SSL.

Is there a way to have IIS serve up an SSL certificate from another server? In other words, is there a way to be a trusted man in the middle?

I'm hoping that's possible so that we don't have to require all our clients to re-issue their SSL certs. Frankly, we don't want to have to manage hundreds of certs. I'd also like to avoid a UCC situation if there's a way to because it seems to require re-creating the cert each time a client is added.

So, any pointers on proxying/hosting SSL (or even dynamic SSL hosting like would be appreciated.

share|improve this question

Microsoft TMG can do this. It acts as a MITM by serving up the real certificate for the internet side of the request, decrypts it, then re-signs it with a trusted internal certificate for the local side of the request. You then also sign your local internal web server with an internal certificate, and let TMG do the public-request signing.

This way, you can get TMG to inspect the request as it comes in and reverse-proxy it to the correct location.

I don't quite know how helpful this is for your situation though.

share|improve this answer
Mark, Thanks for the pointer towards this product. Do you know of any documentation that outlines how to do what you're suggesting? I'm totally new to TMG, I'm not sure where to start, and I'm finding little by way of Google. Thanks! – Tyler Brinks Nov 29 '11 at 15:37
@Acoustic - not really I'm afraid. Most of the documentation for TMG is on the technet portals. When you're looking for is under Firewall Rules, then Publish Web Server. When you're after is fairly complex though, so I don't really know where it would be documented. – Mark Henderson Nov 29 '11 at 19:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.