Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am a newbie in SSL setting in IIS.

I want to edit the "multiple ssl identities for this web site". But it just shows "default" and I can't edit it.

What's wrong with that?

share|improve this question
    
Is this IIS 6? Does your server have multiple IP addresses available to bind to? –  mpbloch Aug 4 '09 at 7:29
add comment

2 Answers

SSL certificates are exchanged between client and server before the client asks for a particular object. This is important because one of the qualifiers to the object is the server name. When multiple "names" are put on a site with a single IP, the server uses the requested server name to figure out which object the client really wants.

So if you have multiple sites on a single IP (aka virtual hosting -- for example, the server is www.mysystem.com, and has a virtual site of www.foofoo.com), there is no way for the server to know at SSL-link-time what site the client is going to ask for. This is important because if you have different site names, you (probably) have different SSL certificates that you want to present.

So the server is only going to present a single certificate, which relates to the default site on the IP address. This will cause problems if the client is requesting an object from www.foofoo.com, when the server's default site is www.mysystem.com. In other words, the user is going to get a browser error window saying the presented cert doesn't match the requested site name. (Now we all know the user is 99% probably going to ignore this error page and click through anyways, but it is still unprofessional-looking. And will scare off 1% of the customers trying to connect.)

The solution is to use multiple IP addresses, then bind individual sites to individual IP addresses. You should then be able to add site-specific certs to each individual site.

share|improve this answer
add comment

What about SAN certificates.... multiple sites on a single certificate.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.