0

I have two sites bound to a single IP address (10.10.0.1) on two different domains (xyz.example.com and abc.example.com). HTTPS is bound to port 443 using the certificate for the xyz.example.com domain, and abc.example.com only uses HTTP. This is on an IIS 7.5 server.

I have no problem in getting both sites on http also https works fine for xyz.example.com, but if I try to access https://abc.example.com, it shows the SSL site for xyz.example.com, which I don't want.

Is there a way to block https://abc.example.com? I could not find any similar issues posted around, even though there are solutions for single IP, multiple SSL sites.

  • What do your bindings look like? – GregL Jul 17 '15 at 14:20
  • Perhaps you can make use of Qualys SSL Labs test to see what is wrong? – ngn Jul 17 '15 at 14:42
  • greg , xyz.com - https ,ip 10.10.0.1 , hostname greyed out ( i tried to add it via appcmd , did not make any difference ) for abc.com http , ip 10.10.0.1, host name abc.com ngn - it says certificate mismatch thanks guys – hmd Jul 17 '15 at 15:19
2

This is a limitation in IIS 7/7.5 and SSL/TLS (Pre SNI), since it doesn't allow you to bind HTTPS to a single site, but instead only to an IP address/port combination, so all traffic to that IP address/port will go to the site it's bound to.

Workarounds that you can use for IIS 7/7.5

  • Use rewrite rules to redirect HTTPS traffic to the unsecure site to HTTP
  • Add another IP address for the secure site and bind the secure site to that IP

IIS 8+ supports SNI, which is an extension to TLS that allows host information to be passed in the handshake to allow the server to present the correct site. This requires that the client be SNI capable, but this is the case in all modern browsers. (It's not supported in any version of IE on Windows XP, but that's not modern at this point.)

Similar question was answered on StackOverflow here.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.