1

We deploy a web application (Dynamics CRM) on a single IIS server which should be reachable from the internet.

The application is only accessible with HTTPS. Therefore we need a ssl-certificate, because multiple hosts are used. The certificate will match *.contoso.com.

Internal access to the application requires also HTTPS. We need a certificate for crm.localdomain.local.

Because the SSL connection can only be terminated on the IIS website itself and a restriction of Dynamics CRM which allows only a single HTTPS-Binding on the website, we have to cover this scenario with a single certificate.

Is the inclusion of internal names a problem?

2
  • Sure it's per site and not just the usual per-IP limitation? You could add an IP and a site binding in IIS for an internal cert and see what happens...
    – TristanK
    May 19, 2011 at 10:16
  • @TristanK yes, I am sure. Using multiple bindings either for HTTP or HTTPS is not supported.
    – ccellar
    May 19, 2011 at 11:06

1 Answer 1

4

I dont think its even possible to use localdomain entries on non self signed SSL's

however one possible work around for you, why not make the internal access available on internalcrm.contoso.com and do some internal dns setup that points that domain to the internal crm machine and then it can be part of the wildcard SSL without any problem whatsoever?

3
  • 3
    Whilst you can use .local TLDs in an SSL certificate, no public CA would ever issue it because they can't actually verify your ownership of the domain. May 19, 2011 at 8:40
  • I'll try your suggestion. I'm not sure if will work, because the requested domain has a defined meaning for the request handling. There fore a request to crm.localdomain.local is handled different than a request for crm.contoso.com (this is specific to Dynamics CRM). In your example both URLs share the same domain and atm I'am not sure if this is a problem for the request handling of Dynamics CRM in this scenario.
    – ccellar
    May 19, 2011 at 9:10
  • I've tested your 'workaround' and it works :)
    – ccellar
    May 26, 2011 at 10:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .