Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have a site with multiple HTTP bindings and one HTTPS binding. The cert I'm using for it is specific to one domain (secure.domain.com) and IIS is responding to HTTPS requests over all bindings. I'd like to prevent that! Aside from users randomly navigating our site over HTTPS and ignoring the certificate error, bots have been indexing over HTTPS as well.

The simple solution was to add the binding to a new site and point that site at the same directory, however due to licensing issues I won't be able to do that with this instance.

I've tried giving the cert a friendly name with a * in the beginning and setting the host name, but it didn't seem to work.

Thanks for any ideas!

share|improve this question
    
I believe https SSL is set up for each site's binding group, perhaps create sub sites each with their own binding groups –  scape Apr 9 '13 at 16:07

1 Answer 1

up vote 0 down vote accepted

Maybe try configuring SSL host headers: http://www.sslshopper.com/article-how-to-configure-ssl-host-headers-in-iis-6.html

I'm having trouble picturing your set up, why do you have all of the different bindings for one site? Do they get routed to different folders?

share|improve this answer
    
I have a Sitecore CMS instance with only one license. Any site (domain) that we want to manage has to be pointed at that main site. I spoke with the regional sales manager about the issue and they confirmed that I'd need additional licensing if I just made another site in IIS. –  Ben Schmidt Apr 9 '13 at 18:31
    
Okay, unless the CMS requires multiple IP addresses you don't need to have multiple IP addresses on the site. You can assign all of the DNS names to the same IP address. That with the host headers should help. Are the sites secured or public? Have you tried a robots.txt file? –  Snowburnt Apr 9 '13 at 18:43
    
It doesn't require any more IPs, so we're good on that front. I attempted the host headers fix again and still couldn't get it to not respond when going to main.site.com. –  Ben Schmidt Apr 9 '13 at 19:21
    
Here's an idea: you can use URL rewrite+ARR and make a rule that only allows https traffic if it is on the correct URL. –  Snowburnt Apr 9 '13 at 20:16
    
I'm not sure how ARR would do anything that the URL Rewrite module wouldn't do. I have a rewrite rule setup now to redirect them to HTTP, but it happens after the browser requests the certificate, showing a cert error page that they have to accept before the redirect. –  Ben Schmidt Apr 10 '13 at 14:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.