We are 'Linux minded', so IIS and/or Windows is not my cup of tea, so please spare me. We have a webserver with 6 sites, one of this site is a multidomain site. About 100 domains resolve to the server's IP and bindings have been created for that site and that domain so the visitors are served the files from that site.

This all worked fine, up until today.

In may 2019 a certificate was installed for domain A. No issues. Today a certificate was installed for domain B.

As soon as certificate B was installed IIS would service certificate A on all domains on IPv4 but not IPv6. IPv6 continued to work fine. We checked bindings, they were all okay. I suspect domain B has nothing to do with the issue, but it might have triggered a reload of restart that started all the problems.

We couldn't find any reason why certificate A would be served for all domains.

  • We removed all bindings for domain A. Didn't help.
  • We removed certificate A from the certificate store. Didn't help.
  • We restarted IIS, didn't help.
  • We reloaded IIS, didn't help.
  • We rebooted the entire server: Issue is resolved.

So, when we remove certificate A from the certificate store and reboot the server all issues are vanished and everything works.

In an attempt to try to reproduce the issue we re-imported certificate A into the certificate store. Suddenly the issue is back, IIS is serving certificate A on all domains for IPv4 connections. It is important to notice that at this time we did not recreate the bindings for domain A. Only the certificate was imported. No bindings in IIS were modified, but nevertheless IIS started to act up.

We removed the certificate again, but again this doesn't resolve any issues until we do a complete server restart.

I then imported another random certificate, lets call it domain Z. No problems with IIS. So I suspect that there is some kind of strange issue with the certificate for domain A.

We requested a new certificate for domain A from the supplier, and that certificate also works fine.

So it looks like this specific certificate for domain A (the first one) is somehow broken and is causing all IPv4 bindings in IIS to act up. A new version of domain A's certificate does not have the same problem.

I hope someone can help me with:

  • What would cause this issue to occur?
  • Why has importing a certificate in the store have an effect on site bindings?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.