Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to have a single site in IIS6, with multiple domains (not subdomains) some domains using SSL? The domains with SSL using a unique IP.

I've read similar situations, but nothing exactly the same as this. But close enough to think that it might cause problems.

I've possibly seen that wildcard ssl's might help due to them not being as mapped to IP address?

share|improve this question

2 Answers 2

No, one SSL enabled site requires one IP address. No way around it. You will see people talk about "work-arounds" using wildcard certificates, but they are confusing two different things. They are confusing a subdomain, which a wildcard certificate can be used for, with a different domain which is not what wildcard certificates will work with.

The web server needs to be able to determine which installed SSL certificate on your server to use when it receives a request that has been encrypted with SSL. In a non-SSL based site, the HTTP header contains the requested domain of the site. This is what allows you to use the host headers feature to support multiple non-SSL websites on a single IP address. Meaning, the server looks at the request, determines the requested site based on the host in the header of the HTTP request, and then passes it to the configured site.

When you have an SSL based site, the new page request comes into the web server already encrypted. Since the header of the HTTPS request is also encrypted, the webserver cannot just look at the requested domain and use the host header feature. It must use the SSL certificate bound to a specific IP address to decode the HTTPS request before it can process the header. While it might be possible for a web server to try to decode the request using all installed SSL certificates on the machine to try to implement an SSL based host header feature, this would slow down HTTPS processing considerably. Hence, the only way to do SSL is by having a single IP address per installed certificate.

share|improve this answer
    
Thanks dmarietta, so does this also apply to a site which has a unique IP mapped to one certificate, but also the site having a non https domain on another IP (same site)? So could you have one SSL'd domain, but the others not? –  Alex Key Nov 7 '12 at 16:28
    
@alex key, yes, through bindings. but still, only one cert could be used for one top-level domain, regardless. –  scape Nov 7 '12 at 18:02
    
Yes, that combination would work fine. The only limitation is any sites with SSL enabled, you are effectively limited to a single SSL eanbled site per IP address. Use can still use host headers on additional non-SSL sites on the same IP. I say "effective" as you could use a non-standard port for SSL, but this gets confusing/alarming for many end users and in my experience, I would not recommend it for anything that is a public access site. –  dmarietta Nov 16 '12 at 20:31

Yes, it is possible.

To do so you would create a binding for each host name e.g. www.site1.com www.site2.com etc…

HTTP bindings may share the same IP address if you use host headers in the binding. Alternatively you can still use one (1) IP to one (1) host name.

Each HTTPS binding must use a separate IP address, but you can assign more then one IP address to a site. This is because HTTPS is an encrypted tunnel using SSL/TLS. When the tunnel is established, it is between IP addresses because it has no way to tell the web server what host name it wants to connect to. The Host header is a feature of HTTP not TLS/SSL. After the tunnel is established it is too late to choose another binding.

For binding information also see http://serverfault.com/a/445685/94787

Also note that while IIS supports it, the web site will still need to support it, which it may not.

share|improve this answer
    
Thanks @Bernie White, just to confirm, will this work in IIS6? –  Alex Key Nov 8 '12 at 9:36
    
Yes. I think it even worked on IIS5. One of the answers here has a screen shot of it if you are not sure serverfault.com/questions/47165/…. –  Bernie White Nov 8 '12 at 10:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.