Possible Duplicate:
Multiple SSL domains on the same IP address and same port?

I have the following situation:

  • first domain: test.domain.com
  • IP:
  • Port: 443
  • SSL: Purchased from godaddy and specific to that domain
  • Works fine no issues.

I would like to add another site:

  • test2.domain.com
  • IP: the same
  • Port: can be different
  • SSL: different since I can't use the SSL above because it's specific to the site above.

Now, when I add the HTTPS binding to the second site with IP:Port combination it appears to always load the first SSL ignoring the second certificate.

How can I add second SSL binding to the same IP using a "different" certificate? Can this be done?

marked as duplicate by sysadmin1138 Feb 19 '11 at 22:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from stackoverflow.com Feb 19 '11 at 21:06

This question came from our site for professional and enthusiast programmers.

  • Not actually an exact duplicate. Judging by the flags (and the fact that I found this page on Google by looking for that exactly) this question is focused on IIS 7 while the question linked above is focused on Apache. I'm interested in IIS support for SNI – usr-local-ΕΨΗΕΛΩΝ Jan 8 '12 at 19:41

With most of current software you can't have different certificates on the server for the same IP (modern TLS versions have extension for handling this problem, but most clients don't use it yet). So your only options are (a) obtain certificate for several domains (wildcard certificate or alike) or get additional IPs for the system.

  • With godaddy, you can get a UCC certificate which has multiple domains – Steven Feb 19 '11 at 22:43
  • 1
    You use of the word "most" is dubious. IE 7+, Firefox, Chrome, Opera, Safari, the list goes on. Now, IE on WinXP does not support SNI but the competition does. – Phil P Feb 20 '11 at 0:55
  • @Phil P you name the browsers, and there exists numerous other software (whose share can be even larger, than browsers' one) and this software isn't updated as frequently as browsers (and even browsers are not in corporate environments). – Eugene Mayevski 'Allied Bits Feb 20 '11 at 9:40
  • The OP said port 443, thus it's web traffic. If it's not browsers, it's dedicated tools and the provider of the service gets to dictate API requirements, including SNI. – Phil P Feb 20 '11 at 22:14
  • 1
    @Phil "web traffic" doesn't mean browsers. If it's not browsers, it can be any other HTTPS client, not necessarily custom service with capabilities to dictate anything. – Eugene Mayevski 'Allied Bits Feb 21 '11 at 8:55

You could get a Wildcard SSL Cert. That way it would handle all domain names at *.domain.com.

But, the real problem has more to do with webserver configuration. With Apache, you can't have different names for a SSL encrypted server. You would have to run a second SSL encrypted server with a different port. With a different port, you could actually use the same name.

Not the answer you're looking for? Browse other questions tagged or ask your own question.