Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

All right I have the following:

  • ONE External Ip Address.
  • TWO websites on their own physical servers (IIS). (They are separate and they have to remain that way). No virtual hosts.
  • TWO SSL certificates, one for each website

Main website uses the standard external 443 port Secondary website uses the external port 8443


Internally on the LAN I can go to each website, SSL/Certs are correct and fine. I used DNS to point it to the internal ip address.

Externally, will go directly to the "main" website unless I use the 8443 port ...

But when I use externally the SSL Certificate is wrong. It is actually trying to use the certificate. Even though I do not have the certificate on that server.

So what is going on? DO I need to get another External IP Address? Is there a workaround? This link provides a workaround but I can use a virtual host

share|improve this question
up vote 2 down vote accepted

Since you are running the web servers on their own boxes the easiest thing is to have unique IP's and redirect the TCP connections to the backend servers. If you want to go the vhost-route you would need to do the SSL termination on one server (like a frontend haproxy) and then hand out the unencrypted streams to the backend IIS servers.

share|improve this answer

If you only have one public address and 2 physical servers, how is the public address mapped to each server? How is the nat set up?

It sounds like you need this configuration:

public ip / dns record
server1 <---> reverse proxy <---> server2
   |                                 |
website                           website

Because if you only have one address, it can only be mapped to one backend server.
The backend servers have private addresses, right?
So you need to send all public access to server1 and use it as a reverse proxy for server2.

If I am wrong, then I probably need more information from you.

share|improve this answer
As seen at… you can have multiple SSL sites on one IP now. The browser support looks pretty good. I haven't tried it yet. – chicks Aug 11 '14 at 1:44
Not on Windows XP or IE6/IE8, but yeah most browsers support it now. – Vasili Syrakis Aug 11 '14 at 3:01

You can do what @chicks proposes, but it will take some time and coffee to configure and test it. Plus it's not a really good solution if you ask me. Better get that extra IP as long as you cannot co-locate the 2 sites in one server. Virtual hosts only work for websites located in the same server.

share|improve this answer
I agree that getting the extra IP to have one IP per SSL site is the safest and possibly easiest solution. – chicks Aug 11 '14 at 1:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.