0

We have two sites/applications in IIS:

  1. www.corpsite.com
  2. accounts.corpsite.com

As you can see the accounts app has the same TLD and is the only application/site on the server that makes use of an SSL.

Problem:

Browsing to https://www.corpsite.com redirects us to https://accounts.corpsite.com, which it shouldn't. We don't make use of SSL on the www.corpsite.com site, only on the accounts site.

Screenshots:

If you look at the screentshot named www.corpsite.com.gif you'll see that there's no certificate configured on the site.

enter image description here

The accounts.corpsite.com site on the other hand has the certificate installed.

enter image description here

Anyone able to help?

Thanks, Jacques

Improve this question
9
  • What is the cn on the certificate?
    – Greg Askew
    Jul 4, 2013 at 14:54
  • Hi Greg, thanks for the response. A bit clueless here, what is a CN?
    – Jacques
    Jul 5, 2013 at 8:07
  • Sorry Greg, one of my team here mentioned that it refers to Common Name, we'll check it. I've got a feeling I know where you're going with this.
    – Jacques
    Jul 5, 2013 at 8:28
  • We've confirmed the CN is AccountApp.CorpSite.com, so that would seem correct wouldn't it?
    – Jacques
    Jul 5, 2013 at 8:48
  • It is not correct if you are attempting to establish a secure session to www.corpsite.com. You may want to amend your question and specify the server response you are expecting, i. e. an error.
    – Greg Askew
    Jul 5, 2013 at 11:54

2 Answers 2

Reset to default
3

Remove the https binding (443) from the site www.corpsite.com.

As a best practice, use a catch-all binding on your main site (as in port 80 without any host header), and specify the host header on your secondary sites.

Note that host headers on SSL is extremely limited in terms of support out there, so even if IIS on 2003 supports it I wouldn't bother to set it up. If you need SSL on more than one site in the future you should add another IP, or move the application to a virtual directory under your main site.

EDIT: I was wrong, very wrong

http://en.wikipedia.org/wiki/Server_Name_Indication

Seems like every major browser out there supports this now, so I guess the world has moved on since I last checked a few years ago! According to Microsoft, IIS Windows 2003 SP1 and later supports host headers on SSL binding, by using certain command-line tools. Note that you need a wilcard certificate to make it work.

Improve this answer
2
  • Pauska's answer sounds best. Fortunately for me, the client I'm at doesn't have any Win2k3 servers for me to look at :-) (That I know of, anyway.)
    – mfinni
    Jul 19, 2013 at 17:24
  • Thanks Pauska I appreciate the time. It seems though that Wikipedia is reporting that IE6, or any version of Internet Explorer, on Windows XP won't work due to this being a component of the operating system. After reading some more it looks like this issue is by design in Windows Server 2003 and was only fixed in SP1.
    – Jacques
    Jul 22, 2013 at 9:03
1

It sounds like you have the sites on the same IP? Use Host Headers on both sites with the correct name on each.

Improve this answer
4
  • I am pretty sure IIS on 2003 server does not support host headers on SSL - it's barely supported by browsers out there.
    – pauska
    Jul 19, 2013 at 17:18
  • Ick. Double ick, in fact.
    – mfinni
    Jul 19, 2013 at 17:22
  • Turns out there IS a way to do it with IIS 6, but not through the GUI: microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/…
    – pauska
    Jul 19, 2013 at 17:25
  • Turns out I was completely wrong on this, most browsers supports it now. See my updated answer. I've voted on yours as well, since you were correct all along! Sorry about the confusion.
    – pauska
    Jul 19, 2013 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.