We've got a Windows Server 2003 running IIS 6 where we host multiple sites with different domains. www.site1.com, www.site2.com etc.
Now one of these sites need a SSL certificate, so I ordered a certificate from rapidssl.com for the domain www.site1.com.
The problem:
After installing this SSL certificate all https request to this server, regardless of domain, gets redirected to the www.site1.com site.
FYI: This is the only site on the server that got a SSL certificate installed.
Anyone?
cscript.exe adsutil.vbs set /w3svc//SecureBindings ":443:" solved the problem.
According to this site, SSL does not support host headers. If you have more than one IP on your server, try using one IP for the SSL website and use other IPs for the other sites. If you don't, ask for another IP for your server to your helpdesk.
It's possible...
http://www.sslshopper.com/article-how-to-configure-ssl-host-headers-in-iis-6.html
http://www.digicert.com/ssl-support/configure-iis-host-headers.htm
As per post by Kulvis
Related
We have a SharePoint site https://example.com hosted on port 443.
There is another site https://anotherexample.com that should be hosted on same server and without port (i.e. 443).
Both the certificates are issued to different host names (i.e. not wildcard certificate).
How can I achieve above scenario?
Any help is much appreciated!
Edit: I'm working on IIS 8.
Best way to achieve this on IIS 8 is to use Server Name Indication. It allows the server to host multiple certificates for multiple sites under a single IP address.
For more detailed instructions, please refer here.
We used to have a setup on IIS 7.5.
- 1 IIS has 2 websites both run on 443.
- It has different host names in the binding - site1.domainname.com, site2.domainname.com
- Both sites were bound to a wild card SSL cert - *.domainname.com,
and this worked fine for years.
Because of an audit, we had to move to a FQDN certificate.
Now when I bind the FQDN certificate on a site, it does not allow me to add a host name.
http://screencast.com/t/sowdaziJV
It says you can't start the second site as another website is already running on the same port.
This made sense until another internal team got it working. My guess is they used scripting to allow this on IIS instead of IIS GUI.
They have 2 websites running on the same port with different SSL certificate with no Hostnames.
I found out an odd thing about their setup and I was able to set it up like that too.
Have the sites with wild card certs and hostnames.
Change site one with the FQDN cert.
DON'T Change site 2 with FQDN cert.
It automatically takes the new certificate and keep the host name
They both stay up. If you look at site 2, it looks like it has a hostname binding. but if you edit that hostname is gone. See this figure.
http://screencast.com/t/z5y4n7KhGNE
Questions:
Is IIS running 2 websites on the same port with different FQDN certificate an expected behaviour?
I am worried if they took advantage of a bug. I want to be sure if this is allowed before I do this in production.
They probably turned on SNI. SNI allows the server to discern between a host name and route it to the correct site and then send back the SSL cert associated with the site. The problem is, not all browsers support SNI handshakes. SNI only started with server 2012, so the other team might be running that. Previously, IIS couldn't do this, so each site had to have its own IP / SSL cert. Now, you can run all on 443 for one site, and IIS can figure out which site to respond with by looking at the request.
I am having some trouble with hosing.
Currently on our server have have 6 or so IIS sites hosted. They are all http currently: and work on port 80 with the host names set.
Now I want to go an change them to use SSL. But this then removes the ability to use the Host headers.
I have tried using self generated ssl cert from within IIS Manager before I go out and buy real ones. But the issue I am having is that it seems that the SSL cert is linked to an IP address. I can add the ssl cert to one site. But after that When I try assign site 2. it says that there are no Ip addresses.
So My question which Im hoping someone can explain how it works when multiple sites are hosted with iis on the same machine.
Do I have to get a wildcard SSL Certificate?
Do I need to have a unique IP address for each site being hosted?
If not, could somebosy please help and try explain to me what I need to do in order to achieve this.
I was asked to create a sharepoint web application with ssl on a server with sharepoint 2010 installed. The problem is that this port seems to be in use for hosting our subversion repository. So when i try to browse my sharepoint site, it just shows a page with my repository. I've read about installing certificates and configuring multiple sites on one port with host headers but i never succeeded to complete this job. I would really appreciate some help here.
Thanks!
Assuming you're talking about individual SSL certificates (as opposed to a single wildcard certificate), I believe each website HAS to have its own IP address. AFAIK it is not possible to run multiple websites with multiple SSL certificates under the same IP address.
Depending on who is hosting the server, you would need a new IP address to be allocated to the server, and then within IIS you use the new IP address against the hostheader of your new website. You should find that the certificate works correctly, if not then try removing the certificate from the website and re-allocating it.
You would only be able to use a wildcard certificate if the primary domains of the websites were the same (e.g. website1.mydomain.com and website2.mydomain.com).
Thomas,
I've run into a similar situation before where the requirements dictated that we use 1 ip address, but the domains will be different (eg. website1.com, somesite.org, website2.us).
You can achieve this by using a Unified Communications certificate with Subject Alternative names. Currently, Digicert offers a UC certificate that can achieve this, but some other CA's will not.
Essentially you will have 1 certificate bound to :443 on the same ip address. The big drawback to this is that if the cert goes down, all the sites SSL will not work.
You have to manually (via powershell) bind each domain to port 443 however, but the instructions are fairly simple.
Server Name Indication would be another way, but it's not even an option in IIS 6
Can anybody explain why I see another web site at my http secure address. I don't have a certificate. I can manage files from folder httpsdocs but cannot access them from web. Also httpsdocs is empty. https://innovacube.com/
And base of my problem is Google indexes my https domain but I cannot denny Google Bot.
You're sharing IP addresses with another site - you'll see that both www.innovacube.com and www.cokyader.com resolve to 92.199.202.62. HTTP/1.1 allows this because you also send a host header
GET / HTTP/1.1
Host: www.innovacube.com
so the web server knows which site to serve for a given connection.
It isn't, however, possible to do this for HTTPS. The problem is that the certificate negotiation happens before the server gets to HTTP so you can't switch depending on the site that the browser really means. Therefore you can only host one HTTPS site per IP and this IP is hosting cokyader.com. (There are proposed extensions to help fix this but I've never seen any progress on this.)
If you want your own separate HTTPS site then your host will have to allocate you your own separate IP address.
Because you are using shared hosting, and it has been configured with a default SSL site that isn't yours (but presumably belongs to someone who has paid for SSL support and has their site hosted on the same server).