Multiple domains on a 443 port in the same IP address

Question

I hosted one website, “www.example1.com” on port 443 (https) in IIS 7. Now I bought a new domain for “www.example2.com” for the same IP address. I would like to host another site in this domain (www.example2.com) in port 443 (I already used port 443 for "www.example1.com").

How can i do this? Is it possible to host two domains on port 443 in one IP address? If yes, please let me know how to do it right? I am using IIS 7.

Regards, Kartik

Answer 1

It can be done.

SSL host headers in IIS 7 allow you to use the same SSL certificate for multiple IIS websites at the same IP address. Through the IIS Manager interface, IIS allows you to associate only one site for each IP address with port 443 using an SSL certificate. If you try to associate a second site with an IP address with the same certificate, IIS 7 will give you an error when starting the site, stating that there is a port conflict. To assign a certificate that will be used by multiple IIS sites at the same IP address, you will need to configure the SSL host headers by following these instructions.

What type of SSL certificate do you need? Since you can use only one certificate, this certificate should work with all the host names of the websites with which you use it (otherwise you will receive a name mismatch error). For example, if each of your IIS 7 websites uses a subdomain of one common domain name (for example, in the example below), you can get a Wildcard certificate for * .mydomain.com, and it will be protected by site1.mydomain.com, site2. mydomain.com etc.

If, on the other hand, your IIS 7 sites use different domain names (mail.mydomain1.com, mail.mydomain2.com, etc.), you will need to obtain a Unified Communications Certificate (also called a SAN certificate).

Configuring SSL Host Headers on IIS 7 Obtain an SSL certificate and install it in IIS 7. For step-by-step instructions on how to do this, see Install an SSL Certificate in Windows Server 2008 (IIS 7.0). After the certificate is installed in IIS, bind it to the first site by IP address. Open a command prompt by clicking the Start menu and typing "cmd" and pressing enter. Go to C: \ Windows \ System32 \ Inetsrv \ by typing "cd C: \ Windows \ System32 \ Inetsrv \" at the command prompt. In the Inetsrv folder, run the following command for each of the other websites on the IP address that the certificate should use (copy both lines):

appcmd set site /site.name:"<IISSiteName>" /+bindings.[protocol='https',bindingInformation='*:443:<hostHeaderValue>'] Replace <IISSiteName> with the name of the IIS site and <hostHeaderValue> with the host header for that site (site1.mydomain.com) 

Check each website in a browser. It should display the correct page and show the lock icon without any errors. If it displays the web page of the first IIS site, then the SSL Host havent hosts were configured correctly.

Answer 2

You cannot in IIS7 — each HTTPS binding requires a unique IP / port combination because the host header cannot be used to differentiate sites using SSL. This is because the host header is not displayed during SSL communication.

Your workaround is to distinguish between sites by binding to a different external IP address or by binding to a port other than 443. Both options are less than I know.

There is a great MSDN blog here .

Fortunately, IIS8 has a solution in the form of Server Name Index (SNI) .

Interestingly, this is not an IIS quirk . Apache has the same problem as any web server before introducing SNI.

Answer 3

We also host several sites on port 443, but we need UNIQUE IP addresses for each site. You cannot bind multiple sites to port 443 using only one IP address. If there is no workaround, but I do not know about it.

This article may help: http://www.harbar.net/articles/ssl.aspx

Answer 4

I am currently using IIS 6.0. I was able to configure several websites using port 443 and various certificates.

From IIS Manager, go to the website and change the site bindings. Just make sure that the “Require server name” field is checked and leave the IP address as “All unassigned”. Now you use the same port (443) for several sites by selecting the appropriate certificate for the site in the drop-down list of certificates.

Answer 5

If you use a wildcard certificate, just use the * .domainname.com format in a friendly name, and the IIS GUI will enable host name management for you when editing the binding.

The picture tells ...

Source: http://blog.angelwebdesigns.com.au/setting-up-a-wildcard-certificate-for-multiple-sites-in-iis-7/