Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Consider an IIS6 installation with multiple Web Sites. Each is intended to be a different subdomain with its own cert (not a wildcard cert). Each has their host-header specified properly.

  • foo.example.com - port 443. Require SSL w/128 bit. Working properly! It presents its SSL cert properly to the browser. Configured for a specific IP address.

  • bar.example.com - port 443. Require SSL w/128 bit. Configured for all unassigned addresses. When inspecting the IIS property page, it fully shows the cert for bar.example.com on the View Certificate button. This is a NEW web site that is having cert problems. It's presenting the cert for foo.example.com. Ouch!

alt text

Question: can you have more than one subdomains both running on separate websites with SSL certs on the same port (443)? How would you configure 2 web sites on the same range of 'all unassigned' for the same port (443) ?

Update: ignoring the cert error, when browsing to https://bar, the content served is from https://foo site.

When NOT using SSL, browsing to http://bar serves the correct content from bar.

Just one address is assigned to this DMZ server.

share|improve this question
    
If you ignore the certificate error, do you get the correct content from bar.example.com, or do you get content from foo.example.com? –  Mark Henderson Aug 24 '09 at 22:11
    
Also, how many internal IP addresses do you have assigned to the server? –  Mark Henderson Aug 24 '09 at 22:15
    
Thanks Farseeker, a few updates above. –  p.campbell Aug 24 '09 at 22:21
add comment

3 Answers 3

up vote 6 down vote accepted

SSL certificates are bound to the internal IP address of the web server, not the external IP addresses.

Let's say you have foo.example.com bound to Public IP A and bar.example.com on Public IP B, but your web server only has the IP address 192.168.0.1

Whether the request comes in on IP A or IP B, it is still going to end up at 192.168.0.1. Which means that IIS has no choice but to use the certificate that is assigned to foo.example.com.

To work around this issue, you will need to have multiple IP addresses assigned to your web server. This is easy to do. Speak to your sysadmin to have some IP's removed from the DHCP range (or ask him/her which ones you can use), then go to your properties for the network card (Control Panel > Network Connections), and go to the properties for TCP/IP.

You will need to have a static IP enabled in the first place (being a server I hope this is done anyway), and then click Advanced, and under the box for "IP addresses" click "Add" - and enter the new IP addresses you've been assigned by your sysadmin (Let's say 192.168.0.2).

Then, at your router, you need to ensure that requests from IP A on port 443 go to 192.168.0.1 and that all other requests on port 443 go to 192.168.0.2.

Then, in your IIS configuration, you need to bind the SSL Cert from foo.example.com to 192.168.0.1, and bind the rest to 192.168.0.2 (or leave as All Unassigned, as you have).

If this doesn't work, or you already have this configured, update your question and leave a comment to let us know.

Update: I just saw your comments, thanks for the update. You will need to ensure foo.example.com and bar.example.com are on two different public IP addresses. The reason being that because the packets are encrypted, there's no way you can use hostname based routing to send the request to the right IP address (I believe this is the case. If anyone knows different, let me know). The only part of the request that's visible to the routers is the destination IP. This is why you can only have one SSL per IP address. So you will need to have public IP's for this to work, and in your DNS an A record for bar.example.com that is different to foo.example.com.

share|improve this answer
    
Mark, we have only one of the two websites that requires ssl, say htts://bar.example.com, but when we type in foo.example.com it comes up with the cert error and if you ignore and continue it goes to bar.example.com. –  Jacques Jul 11 '13 at 16:17
    
Mark, we have only one of the two websites that requires ssl, say "bar.example.com";, but when we type in foo.example.com it comes up with the cert error and if you ignore and continue it goes to bar.example.com. The cert is specific "bar.example.com" and we don't want any SQL on foo.example.com. Looking at the iis properties for foo.example.com the button for view certificate is disabled, so I don't think there is any certificate configured for it. How can we stop people from attempting to browse to foo.example.com –  Jacques Jul 11 '13 at 16:24
add comment

In support of Farseeker, from Thawte:

Although the certificate is not tied to the IP address a unique IP address must be assigned to the domain as SSL is IP based and does not resolve to name based virtual hosts

If your server has only 1 IP address, the "All unassigned" can do nothing but point to that same, single IP address.

share|improve this answer
add comment

It sounds like "bar" is going to the same IP address as "foo" is using. Since "foo" is specifically configured to answer on that IP address, it grabs the request. The "host headers" don't apply for SSL requests (that's why IIS has a separate panel for standard requests with the ip/host/port mapping and another for ssl ip/port mapping, but no hostname).

Check your DNS records and ensure that "bar" is using a different IP from "foo" and your problem should be corrected.

When I configure SSL sites I give each domain that needs SSL its own IP address, and use a "common" IP for everything else. The DNS records, of course, need to use the correct address so that the correct site entry in IIS will handle the traffic.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.