We have different Web Sites on different IIS Servers belonging to the same Domain as site1.example.com, site2.example.com, site3.example.com. However, we have no idea about how to use the same certificate on different IIS Servers and Web Sites. So, which steps should we apply in order to use the certificate of example.com on different IIS Servers for these Web Sites? Could you please clarify us regarding to this issue?

  • Does the friendly name/Subject of the certificate match the domain name of all the web sites? – Greg Askew Mar 20 '16 at 20:32
  • Yes, all of them will use example.com. – Jack Mar 20 '16 at 20:46

You may issue different x509 certificates for every host or site. Or, if using one certificate, subject alternative names and wildcard host names are commonly supported.

There are a great many tutorials on TLS and x509 certificates. Here is one introduces the topic: How to Use X.509 Certificates and SSL For Secure Communications

  • Thanks for your answer. Our certificate type is SHA2 and I am not sure if there is something we should do in order to use this SHA2 certificate on site1.example.com, site2.example.com, site3.example.com. Any idea? – Jack Mar 21 '16 at 8:36

There are three steps involved here:

  1. Actually purchasing the certificate
  2. Installing the certificate on one server
  3. Exporting the public/private keys of the certificate for installation on additional servers

Actually purchasing the certificate

In order to secure multiple subdomains of the same domain, you have two options.

  1. UCC (Unified Communications Certificate) certificate: UCC certificates can be used to secure multiple subdomains, but you must know which subdomains you want to secure when you purchase the certificate. When you generate the CSR (Certificate Signing Request), you will be required to enter the various subdomains as SANs (Subject Alternative Names).
  2. Wildcard certificate: Can be cheaper or more expensive than UCC depending on how many subdomains you need to secure. You might have no choice as well if you don't yet know all the subdomains you need to secure.

Installing the certificate on one server + Exporting the public/private keys of the certificate for installation on additional servers

This is largely platform dependent if you need the actual steps, so if you do, let me know your OS and IIS version and I'll edit my answer.

  • Many thanks fr your answer. Actually I have no idea about the steps regarding to this issue. As we use Wildcard certificate, could you please add to your answer the necessary steps about installing certificate on the main server and generating key or etc. for the subdomain servers (on the same IIS and on a different IIS)? In addition to this, we would be appreciated if you indicate the tool or steps to do this. Thanks in advance. – Jack Mar 24 '16 at 7:11

Use the same process to import the certificate PFX into the local machine Personal/My store using the Certificates MMC on the other IIS servers, then use IIS Manager to select the certificate.

If you do not already have the certificate PFX, export it from one of the existing IIS servers that may have the certificate.

If the certificate private key is marked as "not exportable", you may use JailBreak to export the certificate.

  • Thanks for reply. Actually we have SHA2 type certicicate in *.cer, *.crt, *.pfx formats and we are wondering if we should import the same file to all of the IIS Servers or Web Sites? Or should we need an extra process i.e. generating key, etc. to the SSL certificate for each of IIS Server or Web Sites where the certificate to be exported? Any idea? – Jack Mar 21 '16 at 8:39
  • The PFX should have the public and private keys, and this would be the file that you import (yes, the same file) to all IIS servers/websites – Jai Govindani Mar 24 '16 at 3:25

You can use a wildcard certificate (*.example.com) and import it on a server. The same can be said for a certificate with different subject alternate names. For simplicity, a pfx-type of certificate is the easiest. You can import this certificate on all servers and use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.