Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an IIS server hosting several websites, like:

example.com
subdomain1.example.com
subdomain2.example.com

I want those websites to be able to use SSL.

If I install the certificate *.example.com, subdomain1.example.com and subdomain2.example.com work well, but when accessing example.com, Chrome shows a "This is probably not the site you are looking for!" message, as expected.

If I install the certificate example.com, then the first website work, but two other fail with the same message, as expected too.

What can I do to make both domains work, taking in account that there is only one IIS server with only one IP address?

Note: there is no such a thing as *example.com certificate, and all three websites will show the same error message.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

What you're looking for is a SAN (or UCC) certificate.

share|improve this answer
1  
Some certificate authorities will also include the "base" domain name as a subjectAlternateName on a wildcard certificate. –  Shane Madden Apr 11 '12 at 19:43

As an alternative, if you have already purchased you SSLs for each of the aformentioned SSLs... you could assign each its own external IP address and then add the appropriate HTTPS bindings in IIS for those IPs with the corresponding SSL.

share|improve this answer
    
With IIS 7 and above it is now possible to include several HTTPS bindings on the same IP as well. –  Tim Brigham Apr 17 '12 at 2:41
    
But Tim, how would IIS know what SSL to use to decrypt the request? I conjecture IIS might not allow this. –  Chris Anton Apr 17 '12 at 2:45
    
Ok, looks possible to use one ip with multiple SSLs using UCC with SAN. AAAAND IIS8 HAS SNI learn.iis.net/page.aspx/1096/… –  Chris Anton Apr 17 '12 at 2:48
    
I stated that incorrectly. Multiple subdomains with different content on separate IIS sites may be hosted behind a single public IP and a single certificate. My bad for not reading closer. The SNI stuff doesn't look too well developed yet. Maybe that is just my paranoia though. –  Tim Brigham Apr 17 '12 at 2:54
    
Makes sense Tim! –  Chris Anton Apr 17 '12 at 12:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.