Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

All right I have the following:

  • ONE External Ip Address.
  • TWO websites on their own physical servers (IIS). (They are separate and they have to remain that way). No virtual hosts.
  • TWO SSL certificates, one for each website

Main website uses the standard external 443 port Secondary website uses the external port 8443

Example:

Internally on the LAN I can go to each website, SSL/Certs are correct and fine. I used DNS to point it to the internal ip address.

Externally, https://remote.somedomain.com will go directly to the "main" website unless I use the 8443 port ... https://remote.somedomain.com:8443

But when I use https://remote.somedomain.com:8443 externally the SSL Certificate is wrong. It is actually trying to use the https://main.somedomain.com certificate. Even though I do not have the https://main.somedomain.com certificate on that server.

So what is going on? DO I need to get another External IP Address? Is there a workaround? This link provides a workaround but I can use a virtual host

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Since you are running the web servers on their own boxes the easiest thing is to have unique IP's and redirect the TCP connections to the backend servers. If you want to go the vhost-route you would need to do the SSL termination on one server (like a frontend haproxy) and then hand out the unencrypted streams to the backend IIS servers.

share|improve this answer

If you only have one public address and 2 physical servers, how is the public address mapped to each server? How is the nat set up?

It sounds like you need this configuration:

public ip / dns record
   |
nat/firewall
   |
server1 <---> reverse proxy <---> server2
   |                                 |
website                           website

Because if you only have one address, it can only be mapped to one backend server.
The backend servers have private addresses, right?
So you need to send all public access to server1 and use it as a reverse proxy for server2.

If I am wrong, then I probably need more information from you.

share|improve this answer
    
As seen at digicert.com/ssl-support/… you can have multiple SSL sites on one IP now. The browser support looks pretty good. I haven't tried it yet. –  chicks Aug 11 at 1:44
    
Not on Windows XP or IE6/IE8, but yeah most browsers support it now. –  Vasili Syrakis Aug 11 at 3:01

You can do what @chicks proposes, but it will take some time and coffee to configure and test it. Plus it's not a really good solution if you ask me. Better get that extra IP as long as you cannot co-locate the 2 sites in one server. Virtual hosts only work for websites located in the same server.

share|improve this answer
    
I agree that getting the extra IP to have one IP per SSL site is the safest and possibly easiest solution. –  chicks Aug 11 at 1:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.