0

I recently added a fourth SSL "COMODO RSA" cert to my IIS10 Server 2016.

This is a dev server so we have one IP address and use host headers for a variety of domains in IIS.

If i inspect bindings they are tied to the correct certificate and also the checkbox for "Require Server Name Indication" is on.

When the site is accessed the browse has a ssl warning and if inspect the cert it says "Issued to: localhost" .

I used mmc to look at the servers Local Computer \ Personal \ Certificates and they are there. I have restarted iis , restarted the server, reissued cert and the issue persists.

What else can i check?

  • 1
    Does netsh http show sslcert look ok? (It lists what has been configured with http.sys, rather than what is configured in IIS) – Håkan Lindqvist Jan 11 '19 at 18:53
  • Thanks - from that result i assume i need to focus on the IP port that is not 0.0.0.0:##### So that leaves me with looking at some Certificate Store Name being "My" and some being "WebHosting" and there are two certificates at the top that do not have any Hostname:port and instead have IP:port. So for the ones that are IP:port - are they overriding? ex: IP:port : 172.16.10.131:443 Certificate Hash : f4ee064e26b5b5586d8db6c98931ee06230d8ab1 – phoenixAZ Jan 11 '19 at 20:01
  • should i be trying to find a way to remove the two entries with no host header? – phoenixAZ Jan 11 '19 at 21:19
  • That sounds like something that would be worth investigating, at least. Particularly if one of those certs has a fingerprint that matches the one that is actually used – Håkan Lindqvist Jan 11 '19 at 22:18
  • 1
    In most cases if you only use SNI bindings, you should get rid of IP based bindings, docs.jexusmanager.com/tutorials/https-binding.html#background That should expose what exactly was wrongly configured on your machine. Try to first locate the certificate (CN=localhost) and then figure out why it is sent by IIS. – Lex Li Jan 12 '19 at 16:19
0

I returned to the problem machine. Removed all four of the SSL Certs (I used Jexus instead of the two methods last time tried repeatedly - IIS UI and sometimes certificate snap in method used before). I re-ran “netsh http show sslcert” and nothing was tied to the 172.16.. Ip any more. I carefully reloaded from IIS Manager (“Complete Certificate Request” and pointed to the *.p7b files) and tested first domain fine - then added the other 3 domains and all is working.

When it is now working “netsh http show sslcert” has a single binding with ip address and 443 (lines removed for readability):

IP:port                      : 172.16.#.#:443
Certificate Store Name       : My

Hostname:port                : dev.????rep.com:443
Certificate Store Name       : My

Hostname:port                : www.????eom.com:443
Certificate Store Name       : My

Hostname:port                : dev.????eady.com:443
Certificate Store Name       : My

Hostname:port                : dev4.????ter.com:443
Certificate Store Name       : My

Hostname:port                : ????eom.com:443
Certificate Store Name       : My
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.