Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking to add a SSL cert to our website, which normally is a simple matter, but we have run into a complication that I am currently unsure how to work around/resolve.

Our server is currently securing a site that is a redirection from another server and we are finding that we cannot bind two certs to the same ip.

History
Some time ago, our Marketing department wanted our users to be able to log into the application site from our public site (company.com) and retain the url of 'app.company.com'. The public site is created and maintained by another organization, with the entire site already under https.

To facilitate their request, we created a new site, 'app' on the application.com server, installed their cert, and bound it to the 'app' site. This site uses the host name 'app.company.com' and points to the same folder/code as the application.com site.

We now need to secure the application and all access from application.com, but are unsure how to move forward.

So far, we have tried replacing their cert with ours, which does work but brings the 'cert does not match domain' warning on the client, which we need to avoid. We have tried to add our cert to the default site in application.com, but we get the 'binding is also assigned to another sites binding', which prevents the access from the public site.

Current setup
                        ss

share|improve this question
    
Appreciate the offer! Forgive me, but I am not sure how to post it through ServerFault without the rep, but the image is available at the link in the question. –  OverForkOver Feb 7 '13 at 19:16
    
Ahh, cheers slm! –  OverForkOver Feb 7 '13 at 19:35
    
Can you get a second IP address for application.com and bound the certificate against that? In IIS7.x each IP address can only have one cert. With a second address you can add a second cert. –  Peter Hahndorf Feb 7 '13 at 19:47
    
@PeterHahndorf - Can you add you comment as an answer? Would like to be able to give proper credit if we go this route, which looks likely. –  OverForkOver Feb 11 '13 at 20:25
add comment

3 Answers

up vote 0 down vote accepted

You you get a second IP address for application.com and bound the certificate against that?

In IIS 7.x each IP address can only have one certificate assigned. With a second address you can add a second certificate and use both.

share|improve this answer
add comment

Do you have to use the *.company.com wildcard certificate? You could get a Unified Communications cert (with Subject Alternative Names) that cover app.company.com and app.application.com with one certificate.

share|improve this answer
add comment

There are three possible solutions. The first two mentioned above.

Possible solutions

1) Give your server two IPs, that way it can respond with a different cert on each one You can only have a single certificate on a given IP and port. Which is to say that the server which responds on port 443 encrypts its traffic using the certificate before doing anything else - so before it looks at what site you want to connect to. Normally this means one cert, one server but this lets you have your cake and eat it. Its the ideal solution.

2) Get one cert with multiple valid addresses - you can get certificates with multiple names within them, thus the Subject Alternative Names field could contain app.company.com and app.application.com and so anyone connecting would consider the server as being ok.

3) A kludge you see quite often is to run https on alternate ports to 443. You set up a redirect from http://app.company.com to https://app.company.com:444 and install the cert on the server which is responding to 444. You do the same for http://app.application.com. It is a kludge, but should work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.