2

I'm an apprentice at a small company who provide EPOS systems and create e-commerce websites for people. Two of my managers have left and i have been left in charge of everything web-related (including the server that the websites are hosted on), which you could imagine being a lot of stress.

Now for the issue:

The server that all of our websites are hosted on is a Windows 2012 R2 server, running iis 8.5. We have a couple of websites with SSL certificates and all bindings are using SNI, which i am guessing it needs because they are all on the same IP address and port.

It has been fine using these for a while (or i thought it was) but i have just been notified that a plugin, for one of the websites, is not working properly because of SNI being enabled for that website.

The person i spoke to explained that the plugin would only work if SNI was disabled for this site, however, when i disable SNI for the https bindings, none of the other websites with SSL certificates work. All of the other certificates start linking to the website without SNI.

So my question is:

Is there something i can do to allow the websites to work without one of them having SNI enabled?

thanks for any help you can give me.

  • What sort of plugin are we talking about? Something like a WordPress one? – ceejayoz Jul 19 '18 at 14:09
  • 2
    SNI and traditional SSL sites can co-exist on Windows Server 2012 R2. So... Add another ip address to the server, change the bindings on the non-SNI website to use this new ip address. – joeqwerty Jul 19 '18 at 14:14
  • It would be critical to run netsh http or a tool like Jexus Manager to check your server's certificate bindings, jexusmanager.com/en/latest/tutorials/… Like @joeqwerty commented above, even if this server has only one IP address, you can configure a single IP based binding, without many SNI bindings. Then each HTTPS site can map to the proper binding. – Lex Li Jul 20 '18 at 2:18
  • @ceejayoz The plugin is for Joomla! Virtuemart, and is a payment gateway that connects to WorldPay. I spoke to their support and they said that the plugin does not support SNI. Thanks joe and lex, i will give this a go. – LukeBurke_PremierEPOS Jul 20 '18 at 8:07
5

Sure. You need one IP address per Certificate.

SNI is there for a reason and I would slap the idiot if provider around who does not support SNI in the year 2018. Heck, it was standard in 2010 or so. MS was late to the party server wise, IIRC.

| improve this answer | |
  • This answer has one tiny issue. SNI became part of the standard in 2003, in RFC3546, not 2010. – Lex Li Jul 20 '18 at 2:21
  • Yeah, ouch ;) I Just remmeber MS being late to the party with their IIS version. – TomTom Jul 20 '18 at 4:41
1

Okay, so I got this sorted out.

For anyone interested, read how it was done below:

The website plugin required no SNI for this particular website and I needed SNI enabled, however, I also needed to set up a default SSL website. I went to the bindings for the website that i was having trouble with and added the following binding.

Bindings image

The SSL certificate selected is the one for the site selected.

you also have to ensure that no other 443 bindings have SNI unchecked.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.