Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking to add a SSL cert to our website, which normally is a simple matter, but we have run into a complication that I am currently unsure how to work around/resolve.

Our server is currently securing a site that is a redirection from another server and we are finding that we cannot bind two certs to the same ip.

Some time ago, our Marketing department wanted our users to be able to log into the application site from our public site ( and retain the url of ''. The public site is created and maintained by another organization, with the entire site already under https.

To facilitate their request, we created a new site, 'app' on the server, installed their cert, and bound it to the 'app' site. This site uses the host name '' and points to the same folder/code as the site.

We now need to secure the application and all access from, but are unsure how to move forward.

So far, we have tried replacing their cert with ours, which does work but brings the 'cert does not match domain' warning on the client, which we need to avoid. We have tried to add our cert to the default site in, but we get the 'binding is also assigned to another sites binding', which prevents the access from the public site.

Current setup

share|improve this question
Appreciate the offer! Forgive me, but I am not sure how to post it through ServerFault without the rep, but the image is available at the link in the question. – OverForkOver Feb 7 '13 at 19:16
Ahh, cheers slm! – OverForkOver Feb 7 '13 at 19:35
Can you get a second IP address for and bound the certificate against that? In IIS7.x each IP address can only have one cert. With a second address you can add a second cert. – Peter Hahndorf Feb 7 '13 at 19:47
@PeterHahndorf - Can you add you comment as an answer? Would like to be able to give proper credit if we go this route, which looks likely. – OverForkOver Feb 11 '13 at 20:25
up vote 0 down vote accepted

You you get a second IP address for and bound the certificate against that?

In IIS 7.x each IP address can only have one certificate assigned. With a second address you can add a second certificate and use both.

share|improve this answer

Do you have to use the * wildcard certificate? You could get a Unified Communications cert (with Subject Alternative Names) that cover and with one certificate.

share|improve this answer

There are three possible solutions. The first two mentioned above.

Possible solutions

1) Give your server two IPs, that way it can respond with a different cert on each one You can only have a single certificate on a given IP and port. Which is to say that the server which responds on port 443 encrypts its traffic using the certificate before doing anything else - so before it looks at what site you want to connect to. Normally this means one cert, one server but this lets you have your cake and eat it. Its the ideal solution.

2) Get one cert with multiple valid addresses - you can get certificates with multiple names within them, thus the Subject Alternative Names field could contain and and so anyone connecting would consider the server as being ok.

3) A kludge you see quite often is to run https on alternate ports to 443. You set up a redirect from to and install the cert on the server which is responding to 444. You do the same for It is a kludge, but should work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.