3

I have two Server but just one IP and the need to run on both a Site under the port 443.

I've found out that it is also possible to run multiple SSL web sites on 443 using a shared IP address by making use of Host Headers, however this requires a Wildcard Certificate and a metabase configuration change. But that sounds really bad so I would prefer to use any other solution.

I don't know if it is important that the Domain (certificate) mysub.domain.com is verified by verisign

2 Answers 2

2

The SSL negotiation, including the browser analyzing the Common Name field of the certificate to compare against the host it attempted to connect to, occur long before the server has a chance to see a request. Because of this the server cannot deliver a certificate based upon the Host: head in the request. A wildcard certificate resolves this only because the same certificate is used for each hosted site.

For example if you have a *.example.com cert and you use it to host (based on Host header):

blog.example.com
www.example.com

In each case the certificate is valid for the site hosted and the browser will be happy.

4
  • 1
    This is not correct, as server name indication was created specifically to address this limitation.
    – Razor
    May 18, 2011 at 15:42
  • thanks for that information. But I only care for the certificate on one of the Server. The other is just a sort of demo an not yet attached. I hope I don't get you wrong, but you also say there is no way to this (ignoring the wildcardcertificate)?
    – sra
    May 18, 2011 at 15:43
  • Razor: Unfortunately adoption isn't high enough for the TLS SNI methods just yet. Most sites don't want to exclude the collection of unsupported browsers just yet. Hopefully soon...
    – Kyle Smith
    May 18, 2011 at 19:21
  • 2
    sra: You could serve the existing certificate for both sites and use a host-based configuration but you'll have to override every single security warning your browser throws up and it tells you you're visiting the worlds worst web page.
    – Kyle Smith
    May 18, 2011 at 19:22
3

It is possible to handle different domains with different certificates correctly over the same IP/port, thanks to server name indication.
However, this only works with recent browsers (IE8/winXP does not support it), which means that unless you can afford to not support them, you really need to add either IP or ports.

3
  • thanks for that additional information but I can't do this :(
    – sra
    May 18, 2011 at 15:47
  • @Kyle Can't I identify the site over a foldername (mysub.mydomain.com/folder/) and fetch the request from the other server?
    – sra
    May 18, 2011 at 15:50
  • Sure you can, sra, if you set up a proxy for /folder/ to deliver the content from the second site. I don't know how to do this in IIS, however.
    – Kyle Smith
    May 18, 2011 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .