I've set up Centralized Certificates on my IIS 8.5 (Windows 2012 Standard). I have the following certificates available, among others:

CN=*.dev2.pressero.com, OU=Domain Control Validated
CN=*.pressero.com, OU=Domain Control Validated

I set up a site with the https binding platform.dev2.pressero.com (port 443). I expected it to use the first certificate above, but it is using the second (and therefore not connecting due to name mismatch).

Do I have any alternatives here, other than removing the second certificate from the centralized store?

[EDIT 1] Here are the files in my shared SSL store. As you can see they all match the specification stated by the link given in the comment. [EDIT2: no they're not. Trying rename.]

[EDIT3]: After renaming, same problem. I even tried adding a copy of _dev2.pressero.com.pfx that was named exactly the site name. It still wants to use the *.pressero.com cert. IIS restarted several times.


When you export your SSL certificates to a pfx file, name the certificate the same thing that will be used as the host header value for your SSL binding. This designation is how the correct certificate is located and loaded for a site since you no longer bind a specific SSL certificate to a site when using this configuration.


From here: http://www.orcsweb.com/blog/terri/making-ssl-administration-easy-iis8-centralized-certificates-store/

But wait there's more!

Wildcard certificate

The IIS provider uses the underscore character as a special character to indicate that it is a wildcard certificate. If the subject name in the SSL certificate is *.contoso.com, then the file name should be "_.contoso.com.pfx". NOTE: IIS provider would first try to search for a SSL certificate with the filename that exactly matches the domain name of the destination site. For example, if the destination site is www.contoso.com, the IIS provider first tries to locate www.consoto.com.pfx. If that is unsuccessful, then it tries to locate _.contoso.com

From here: http://blogs.msdn.com/b/kaushal/archive/2012/10/11/central-certificate-store-ccs-with-iis-8-windows-server-2012.aspx

So the moral of the story is: Underscores.

  • This is not helpful (yet). Both of these are named as you describe. The problem is that it is cutting two elements from the full name instead of one; it is using the less specific wildcard cert instead of the more specific one. – Ross Presser May 6 '15 at 18:17
  • I do have _export on many of these pfxes, and extra underscores instead of periods. I will try renaming. – Ross Presser May 6 '15 at 18:20
  • Still using the less specific wildcard instead of the more specific one. – Ross Presser May 6 '15 at 18:49
  • Apparently the association between a key from the central store and a binding is "sticky". After renaming, I had to delete the binding and recreate it before it started picking up the right binding from the centralized store. – Ross Presser May 6 '15 at 19:05
  • 1
    And finally I'm pretty sure there is some kind of delay between updating the cert and IIS recognizing it - even if you do an IIS reset or recreate the binding. If you are absolutely sure you have everything right then wait 1 mintue and try again (using the digicert tool) – Simon Jun 15 '17 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.