How to secure a website (iis7.5) that is already has a cert from a redirection from another domain

Question

I am looking to add a SSL cert to our website, which normally is a simple matter, but we have run into a complication that I am currently unsure how to work around/resolve.

Our server is currently securing a site that is a redirection from another server and we are finding that we cannot bind two certs to the same ip.

History
Some time ago, our Marketing department wanted our users to be able to log into the application site from our public site (company.com) and retain the url of 'app.company.com'. The public site is created and maintained by another organization, with the entire site already under https.

To facilitate their request, we created a new site, 'app' on the application.com server, installed their cert, and bound it to the 'app' site. This site uses the host name 'app.company.com' and points to the same folder/code as the application.com site.

We now need to secure the application and all access from application.com, but are unsure how to move forward.

So far, we have tried replacing their cert with ours, which does work but brings the 'cert does not match domain' warning on the client, which we need to avoid. We have tried to add our cert to the default site in application.com, but we get the 'binding is also assigned to another sites binding', which prevents the access from the public site.

Current setup
                       

Answer 1

You you get a second IP address for application.com and bound the certificate against that?

In IIS 7.x each IP address can only have one certificate assigned. With a second address you can add a second certificate and use both.

Answer 2

Do you have to use the *.company.com wildcard certificate? You could get a Unified Communications cert (with Subject Alternative Names) that cover app.company.com and app.application.com with one certificate.

Answer 3

There are three possible solutions. The first two mentioned above.

Possible solutions

1) Give your server two IPs, that way it can respond with a different cert on each one You can only have a single certificate on a given IP and port. Which is to say that the server which responds on port 443 encrypts its traffic using the certificate before doing anything else - so before it looks at what site you want to connect to. Normally this means one cert, one server but this lets you have your cake and eat it. Its the ideal solution.

2) Get one cert with multiple valid addresses - you can get certificates with multiple names within them, thus the Subject Alternative Names field could contain app.company.com and app.application.com and so anyone connecting would consider the server as being ok.

3) A kludge you see quite often is to run https on alternate ports to 443. You set up a redirect from http://app.company.com to https://app.company.com:444 and install the cert on the server which is responding to 444. You do the same for http://app.application.com. It is a kludge, but should work.