My server run IIS 7 with multiple sites. It uses 1 wildcard SSL certification for domain and subdomains (SAN SSL). It were working fine.

Then I installed new SSL certificate (the same type like old one) into IIS. It would, of course, rebind to all sites. It's done with almost all sites.

However, there is still one site (just like other sites), serves the old SSL certficate. In configuration, I can't find any differencies between it and other sites.


site that still serves old SSL - site that serves new SSL

How this expection just possible to occur! That's weird.

So, do you know any way to fix this? Thank you in advance.

Edit 1: I have checked it, by editing hosts file for this subdomain. Result is that IIS is serving the right SSL certificate. Sorry everyone. Poor me.

So the question now is different. Standing before this server to internet is a Fortiweb firewall, and a load balancer. Like this:

IIS server -> Fortiweb firewall -> Load balancer -> router -> internet

Balancer is just a forwarder. The firewall was configured new SSL, so that all domain and subdomains can be accessed from outside. Yeah, they can be, except that subdomain.

Image for firewall

  • Its it clear... have you confirmed the site binding to the new cert? Do you have any cache or proxy in front of the site? – Appleoddity Sep 17 '19 at 14:17
  • Please check the actual certificate mapping docs.jexusmanager.com/tutorials/https-binding.html#background – Lex Li Sep 17 '19 at 14:24
  • @Appleoddity yeah, firewall in front of IIS server. I have edited the post, take a look. Thanks. – Will Sep 18 '19 at 4:04


While we had used SAN certificate for all domain and subdomains for 4 years now, someone had configured this particular subdomain with old SNI certificate in the Fortiweb firewall.

I ended up removing this configuration and it works now.

Thank you for your help.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.