We have the following scenario in testing SNI on Windows Server 2012 R2 with IIS 8. Domain names and IP addresses listed below are fake and for example only.
WEB SITE NAME IP ADDRESS Host Name/Header (SNI) Certificate Domain ============================================================================== x.domain.com 10.10.0.1 x.domain.com x.domain.com y.domain.com 10.10.0.1 y.domain.com y.domain.com
When only 'x.domain.com' and 'y.domain.com' are configured using SNI with their own certificates on the same IP address, both sites work fine in all browsers, but when you select either of the sites, IIS shows displays a message stating "No default SSL site has been created. To support browsers without SNI capabilities, it is recommended to create a default SSL site".
If I create a default SSL site (a site on the same IP address using HTTPS but with no host name/SNI) it breaks the certificates on the other SNI sites on the same IP address. If I add the default SSL site like the following
WEB SITE NAME IP ADDRESS Host Name/Header (SNI) Certificate Domain ============================================================================== somedomain.com 10.10.0.1 NULL somedomain.com
Once that exists (it doesn't matter what certificate I use), the other SNI domains on that IP address generate a certificate error as IIS is apparently feeding the users the certificate for the default SSL site instead of the certificate specified for the site in IIS.
Can anyone please shed some light on how to properly configure the default SSL site in IIS?