Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have multiple sub domains that should point to the same website and the top-level domain should point to another website. All of these are under SSL. For example:

abc.mydomain.com ---> Website A,
def.mydomain.com ---> Website A,
ghi.mydomain.com ---> Website A,
jkl.mydomain.com ---> Website A

mydomain.com ---> Website B,
www.mydomain.com ---> Website B

I have already purchased a wildcard ssl certificate and a dedicated IP. Can both websites share the same IP or should each one have its own IP?

I don't need wildcard host headers or wildcard DNS mapping. Every time, for each new sub-domain I am able to add a new DNS record and a new host header for the Website A.

share|improve this question
add comment

2 Answers

In this case you would need separate ports if they were on the same IP, or separate IPs if you wanted them on the same standard SSL port (443). IIS doesn't support reading host headers and redirecting using SSL. You can use the same wildcard certificate without any issue, but you would need something inbetween IIS and the client (like Microsoft Forefront Threat Management Gateway) in order to do routing by hostname over SSL. (I hope that makes sense)

The reason this happens is because the connection is encrypted and the certificate is validated before the HTTP header is actually sent, so at that time IIS has to know what site it's using beforehand. Now, Firefox does send the hostname in with the initial encryption request but I'm not sure if IIS supports that (or if any other browsers do).

The First Few Milliseconds of a HTTPS Connection has an incredibly in depth description on how HTTPS generally works (through a special debug build of Firefox). As you can see a few paragraphs in TLS supports a server name extension, but as far as I know IIS does not support that extension.

share|improve this answer
add comment

All you need to do is set up SSL Host Headers: http://www.sslshopper.com/article-how-to-configure-ssl-host-headers-in-iis-6.html

You can then secure them all on the same IP address/port.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.