Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Consider a Win 2008 SP2 machine with IIS7. The task is to apply a certificate and host name to the one and only Site on this machine. The site's host headers need to be abc.123.mysite.com

The first step was installing the .pfx to the Personal Store, which was successful.

IIS7 finds the cert as available, but won't allow the entry of a host name. The host name textbox is ALWAYS disabled/greyed out, even before selecting my cert. I've even deleted the default port 80 binding.

alt text

Question: how can I set a host name for this site? Is it a matter of this cert being a wildcard cert? I understand that the SSL request comes into the web server, and the host header in the packet is encrypted. Why then would IIS6 allow the host header to be specified, but IIS7 not?

Update: The cert isn't part of the problem. I've created a new Site on the machine, and when choosing https binding, the host name textbox is disabled.

share|improve this question
add comment

7 Answers 7

up vote 13 down vote accepted

You can't do it from the UI, you have to do it from the command line. Here's a nice walk through of the process:

http://www.sslshopper.com/article-ssl-host-headers-in-iis-7.html

share|improve this answer
4  
handy trick, give the cert a friendly name starting with '*' an IIS won't gray out the host-header box: blog.armgasys.com/?p=80 –  russau Aug 4 '10 at 4:22
add comment

The short answer is that each IP can only have one certificate bound to it, so the certificate binding is going to apply no matter what hostname is directed to that IP address. Being able to specify a hostname would imply that you can have multiple hostname and certificate combinations on the same IP address and port (as you can with non-SSL entries), but this is not the case, so the field is unavailable.

The more complete explanation is that SSL encrypts your traffic, and part of that traffic is the HTTP headers sent by the browser to the server. One of those headers would be the "Host" header which IIS uses to determine which site to load up with the request. Since the certificate needs to be loaded to establish the secure connection BEFORE the request headers are sent, IIS has to select the certificate based only upon the IP address and port number, leaving the "Host" header out in the cold as a factor in determining which site to load, so they don't let you enter one.

Here is an article which outlines the inner workings of the SSL connection in finer detail.

share|improve this answer
    
Thanks for this answer, Justin. I am still unsure why IIS7 doesn't let me specify a host header, even when I pick one of the IP addresses in the list. IIS6 does without any problems. As mentioned, this is the one and only site on the machine. –  p.campbell Dec 23 '09 at 2:56
    
Host headers can work with a wildcard cert, or a multi-domain "UC" cert: sslshopper.com/unified-communications-uc-ssl-certificates.html. In this case the server only has 1 cert to serve even tho there is multiple hostnames. –  russau Aug 4 '10 at 4:24
add comment

Its does work in GUI...

Just make sure the the 'friendly name' of the cert you are installing is the same as the multidomainname you have made for the cert.

ie. *.compnaydomain.com

if you put in 'Nice friendly name' for *.companydoman.com cert, when installing the cert into IIS, it will grey out the host name header box.

If you use *.companyname.com as the friendly name, your golden.

Boom.

Lindsay Rex.

share|improve this answer
1  
Thank you for this tip! In case anybody else can't rename a cert from IIS (can anybody?) you can rename the cert in the MMC snap-in for Certificates. Just load MMC, add Certificates snap-in, select Computer Account, Local Computer. Once you've loaded the Certificates snap-in you can browse to Certiifcates (Local Computer) > Personal > Certificates and right click to select Properties on your cert. Change the Friendly name field to *.yoursite.com and reload the IIS manager snap-in –  Garrett Mar 1 '13 at 1:45
add comment

Actually, you can add a host header via the gui, but it depends on how the certificate is named ... if I give a friendly name of *.xyz.com to my wildcard cert, and select that cert, then i'm able to use the gui. if the friendly name is something like xyzwildcard, and I choose that, then it grays out the hostheader field...

Weird weird

share|improve this answer
add comment

Some machines won't let you edit the host name if the protocol is changed to https or after adding an SSL certificate. IIS can be grumpy at times.

This Windows command will create a new binding with protocol "https", on port "443", host name "subdomain.domain.com", site name "site name". Change those values (in quotes) to meet your requirements. You will then need to delete the old binding if its using port 443.

Run Windows Command Prompt as Administrator

C:>cd C:\Windows\System32\inetsrv

C:\Windows\System32\inetsrv>appcmd set site /site.name:"site_name" /+bindings.[protocol='https',bindingInformation='*:443:subdomain.domain.com']

share|improve this answer
add comment

I think this KB article will shed some light on the issue. In a nutshell HTTP 1.1 host headers are not supported when you use SSL.

What will probably accomplish what you want is to use the SecureBindings metabase key. E.g. cscript.exe adsutil.vbs set /w3svc/websiteID/SecureBindings "ip.ip.ip.ip:443:abc.123.mysite.com

share|improve this answer
    
Doesn't apply to IIS 7. –  davidcl Jan 22 '10 at 17:58
    
that's odd since it worked when we did it... –  Jim B Jan 23 '10 at 1:09
add comment

Why MS takes this OUT of the GUI is beyond me, since, if you have an ASP.NET application that makes use of license files (licx), your site will not work because it shows up as an IP address instead of a domain name. They need to STOP ASSUMING on every new release of their software - IT people do not need to be babysitted by Microsoft! Geez!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.