0

An SSL binding was added in IIS recently for a website on our shared server, but the SNI box was mistakenly not checked.

This caused certificate errors to be displayed for all other websites on the box running under https as, without SNI, the certificate for the new binding was being presented to the client's browser instead of the one relevant to their domain.

Is there any way to enforce that SNI is applied for all https bindings in future? Or any alternative approaches which would prevent this kind of issue occurring again?

Cheers!

  • 1
    This doesn't sound right. You should be able to have one certificate which does not require SNI and have that be used for all clients without SNI support. And having one such certificate shouldn't prevent clients with SNI support from getting the correct certificate. – kasperd Oct 25 '18 at 10:38
  • 1
    There is no way to "enforce" SNI. It is the server administrators' responsibilities to only apply appropriate settings, as non-SNI setting is still valid (who knows if you intend to configure so). If you want to minimize human errors, create a PowerShell script to automate the steps and enforce SNI inside. – Lex Li Oct 25 '18 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.