0

I have a single IIS website which hosts 3 different websites all using the same UCC SSL certificate. (The code of my site examines the host header itself to decide which variation of the site to show).

I fixed my most fatal mistake already for my Internet Explorer users on XP which is to disable the 'Require Subject Name Indication' field in IIS. Since SNI is not supported on Windows XP if it were enabled when an XP user switched to HTTPS they would basically get kicked off the site with no warning (don't tell my boss).

So I completely understand that when a user accesses any one of the 3 sites via HTTPS that all share the same IP, he is sent to the same IIS site and served the UCC certificate. Even XP supports UCC/SAN certificates so the client accepts the certificate and shows the site as expected.

Now.... forget all that and consider a second non hypothetical scenario.

  • Lets pretend I have two sites : cats.com and dogs.com
  • They're different sites and are deployed in two different websites in IIS 8.
  • They're both on the same UCC SSL certificate*
  • SNI is disabled
  • They are both bound to the same IP address

Now consider XP users accessing https://cats.com

Here's how I understand things work:

  • DNS gives the browser back my IP - lets say 1.2.3.4
  • An HTTPs connection is negotiated,but because XP doesn't know anything about SNI it isn't sending an SSL host header (or whatever they're called) but just accessing the secure site via the IP.
  • So IIS will look for that IP associated with an https website binding, and it will actually find TWO.
  • Let's say IIS decides to just serve you the first one - so it gives you cats.com which is what you're expecting. So that's fine.
  • BUT lets say you go to https://dogs.com - shouldn't you be actually served the site for cats.com because SSL on XP doesn't know about SNI for SSL connections and anyway it's disabled in IIS?

Well you don't. You get dogs.com. I've tried this, and cats.com and dogs.com both work from a Windows XP Internet Explorer 8 client.

I just don't understand why this works. I would have expected this behavior only in my first scenario when they all share a single IIS application.

My best guess is that IIS 8 is receiving the host header anyway and being smart enough to route it to the correct website and finds a UCC certificate name. Is that what's happening?

Can someone explain further?

* just to deliberately annoy techically minded cat and dog owners ;-)

2

IIS uses the HTTP Host: header to determine which web site to serve, just as with any other request.

  • so why do we need SNI? do you think I was right in assuming that the first matching site for the IP serves the SSL certificate - and this works for the second site only because it is a UCC certificate – Simon Apr 19 '14 at 23:34
  • That is exactly what is happening. – MDMarra Apr 19 '14 at 23:37
  • 1
    @Simon You need SNI if you want to use separate certificates. – Michael Hampton Apr 19 '14 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.