Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to point user etc without manually adding the header binding in IIS7. Is this possible? If not automatically can I add the host header programmatically?

share|improve this question

Yes you can.

It is possible to use a wildcard SSL certificate and one single IP.

I can detail how to test this using a self-signed wildcard.


  • MakeCert.exe (Which should be part of a visual studio install or downloadable here)
  • winhttpcertcfg.exe (downloadable here)
  • APPCMD (Part of Vista / Server 2008 / Windows 7)
  • 'Certificates' snap-in for Personal and Local Computer using MMC


Execute the following command from a command prompt

makecert -r -pe -n CN=* -ss my -sr currentuser -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 wildcard.domain.cer


  • From the RUN command or start menu, type MMC
  • File > Add or Remove Snap-ins - Select Certificates, Click Add, Select My user account, Click Finish
  • Repeat previous step and select My Computer (then selecting Local Computer)
  • Click OK
  • Expand Certificates - Current User > Personal > Certificates
  • Right click * and All Tasks > Export. The PFX file contains both the public and private key for this cert, hence why your asked for a password.
  • Copy or Move the Certificate from Current User > Personal > Certificates to Local Computer > Trusted Root Certification Authorities > Certificates
  • Import the PFX into Local Computer > Personal > Certificates (this will be the certificate used by your web services.

Now let's create your web servers

  • Tidy up your environment :)

Remove existing demo app pools and sites

%windir%\system32\inetsrv\Appcmd delete site "Demo 1"
%windir%\system32\inetsrv\Appcmd delete site "Demo 2"
%windir%\system32\inetsrv\Appcmd delete AppPool "Demo 1 App Pool"
%windir%\system32\inetsrv\Appcmd delete AppPool "Demo 2 Portal App Pool"
  • Establish SSL Environment

Tell windows that Network Service is allowed access to your wildcard cert. and tell it to bind the cert to port 443 on your IP address

PathToWinHTTPCertCfg\winhttpcertcfg -g -i "" -c LOCAL_MACHINE\My -a “Network Service” -p MySecretPassword
 netsh http add sslcert ipport=<YOURLOCALIPADDRESS>:443 certhash=<CERTIFICATE THUMBPRINT> appid=<A GUID IN THE FORM OF {ab3c58f7-8316-42e3-bc6e-771d4ce4b201}>
  • Create App Pools and Sites

This is the code to create app pools and sites

%windir%\system32\inetsrv\Appcmd add site -id:100 -name:"Demo 1" -bindings:http/*:80:YOURLOCALIPADDRESS -physicalPath:<PathToDemo1Source><PathToPutLogFilesIn><PathToPutTraceFiles>
%windir%\system32\inetsrv\Appcmd set app "Demo 1/" -applicationPool:"Demo 1 App Pool"
%windir%\system32\inetsrv\Appcmd set site /"Demo 1" /+bindings.[protocol='https',bindingInformation='*']

%windir%\system32\inetsrv\Appcmd add site -id:200 -name:"Demo 2" -bindings:http/*:80:YOURLOCALIPADDRESS -physicalPath:<PathToDemo2Source><PathToPutLogFilesIn><PathToPutTraceFiles>
%windir%\system32\inetsrv\Appcmd set app "Demo 2/" -applicationPool:"Demo 2 App Pool"
%windir%\system32\inetsrv\Appcmd set site /"Demo 2" /+bindings.[protocol='https',bindingInformation='*']

...and that should be you ;) Enjoy!

share|improve this answer

As far as I know there are only two options when it comes to host headers in IIS7.

  1. You set up a host header/type/port/ip for each domain you want it to handle.
  2. You set up no host header but include a type/port/ip on the site you want to handle the multiple domains.

The catch with option #2 is it'll respond to any request on that port and you will be unable to use that same port on another site without a host header.

There may be an ISAPI filter you can load at the server level to intercept the request before it gets to the host header part of the processing but it may be easier to set up a script to handle option #1.

share|improve this answer

By setting up a wildcard DNS entry, you can have as many names as you want go to your default website. Once the user hits that website, if you need it to redirect to another site, have your default.asp file look for the HOST header to determine if it needs to redirect, otherwise, go ahead and load the rest of the site.


Wildcard Host Headers with IIS7

List of HTTP headers

I'm not very good with web development, but this should at least get you started.

share|improve this answer
Keep in mind that this method is like method #2 above - you will still need one IP per site. – Joshua May 19 '09 at 13:39
From the way that the support doc was written, it sounds like regular host headers will work, but yes, anything that needs a wildcard will need its own ip. – Wolfgame May 21 '09 at 2:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.