0

I recently added a fourth SSL "COMODO RSA" cert to my IIS10 Server 2016.

This is a dev server so we have one IP address and use host headers for a variety of domains in IIS.

If i inspect bindings they are tied to the correct certificate and also the checkbox for "Require Server Name Indication" is on.

When the site is accessed the browse has a ssl warning and if inspect the cert it says "Issued to: localhost" .

I used mmc to look at the servers Local Computer \ Personal \ Certificates and they are there. I have restarted iis , restarted the server, reissued cert and the issue persists.

What else can i check?

8
  • 1
    Does netsh http show sslcert look ok? (It lists what has been configured with http.sys, rather than what is configured in IIS) Jan 11, 2019 at 18:53
  • Thanks - from that result i assume i need to focus on the IP port that is not 0.0.0.0:##### So that leaves me with looking at some Certificate Store Name being "My" and some being "WebHosting" and there are two certificates at the top that do not have any Hostname:port and instead have IP:port. So for the ones that are IP:port - are they overriding? ex: IP:port : 172.16.10.131:443 Certificate Hash : f4ee064e26b5b5586d8db6c98931ee06230d8ab1
    – phoenixAZ
    Jan 11, 2019 at 20:01
  • should i be trying to find a way to remove the two entries with no host header?
    – phoenixAZ
    Jan 11, 2019 at 21:19
  • That sounds like something that would be worth investigating, at least. Particularly if one of those certs has a fingerprint that matches the one that is actually used Jan 11, 2019 at 22:18
  • 1
    In most cases if you only use SNI bindings, you should get rid of IP based bindings, docs.jexusmanager.com/tutorials/https-binding.html#background That should expose what exactly was wrongly configured on your machine. Try to first locate the certificate (CN=localhost) and then figure out why it is sent by IIS.
    – Lex Li
    Jan 12, 2019 at 16:19

1 Answer 1

0

I returned to the problem machine. Removed all four of the SSL Certs (I used Jexus instead of the two methods last time tried repeatedly - IIS UI and sometimes certificate snap in method used before). I re-ran “netsh http show sslcert” and nothing was tied to the 172.16.. Ip any more. I carefully reloaded from IIS Manager (“Complete Certificate Request” and pointed to the *.p7b files) and tested first domain fine - then added the other 3 domains and all is working.

When it is now working “netsh http show sslcert” has a single binding with ip address and 443 (lines removed for readability):

IP:port                      : 172.16.#.#:443
Certificate Store Name       : My

Hostname:port                : dev.????rep.com:443
Certificate Store Name       : My

Hostname:port                : www.????eom.com:443
Certificate Store Name       : My

Hostname:port                : dev.????eady.com:443
Certificate Store Name       : My

Hostname:port                : dev4.????ter.com:443
Certificate Store Name       : My

Hostname:port                : ????eom.com:443
Certificate Store Name       : My

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .