5

I have an IIS 8.5 server running on our intranet. We'll call it MYIISSERVER. It has only one IP address.

Under MYIISSERVER, I have several sites:

  • Site1 - currently to access this site we use the address http://MYIISSERVER/Site1:8003
  • Site2 - currently to access this site we use the address http://MYIISSERVER/Site2:8004
  • Site3 - currently to access this site we use the address http://MYIISSERVER/Site3:8005
  • Site4 - currently to access this site we use the address http://MYIISSERVER/Site4:8006

I now have to make all of these sites use SSL using the default HTTPS port of 443.

I have read about Server Name Indication(SNI) on IIS 8 and above. From what I understand, this is similar to using host header names on an unsecured site that uses port 80.

What is the best route to take on doing this? Do I get an individual certificate for each site? Do I get a SAN certificate to include all of the sites (if this is even possible for this scenario)?

This is on an intranet. I can ping the server these sites run on by using the FQDN of the server. Currently, there are 5 sites running under this host name using different ports. So when someone on our intranet wants to access one of these web apps, they type http://FQDN:<port>. I now have to make all of these sites use SSL for a secure connection.

What do I use for the host name when setting up the SSL binding? Do I have to have each site registered with DNS?

Improve this question
6
  • Why are they running on different ports? That is an unusual setup because it requires unsightly port numbers in URLs that are hard to remember. Different ports are the same as different IP addresses for SSL in that you don't need SNI or SAN for different ports. In fact, if they are all accessed with the same FQDN, you only need one certificate that is for that FQDN.
    – Stephen Ostermiller ♦
    Commented Dec 5, 2017 at 17:51
  • To clarify, what do you mean by FQDN? Your example of MYIISSERVER isn't fully qualified. Fully qualified would be myiisserver.example.com. SSL certificates have to have the full domain name on them and they won't work if the service is accessed without it.
    – Stephen Ostermiller ♦
    Commented Dec 5, 2017 at 17:54
  • Yes, I know MYIISSERVER is not a FQDN - it was just an example for the server name.
    – Kaine106
    Commented Dec 7, 2017 at 15:40
  • The sites have to be changed to use SSL all on port 443. I am thinking that I can get just one certificate for the server and apply that to all sites on that server. Then set host names for each site in their https bindings. Does this sound like the best way to do it? Obviously, I am not a webmaster. I am not sure what certificate is best to use and how to configure it so that it does work on our intranet.
    – Kaine106
    Commented Dec 7, 2017 at 15:51
  • 1
    If by "in their https bindings" you mean "create virtual host configurations". One certificate would work fine if it is a SAN certificate that covers all the host names.
    – Stephen Ostermiller ♦
    Commented Dec 7, 2017 at 16:01

1 Answer 1

Reset to default
3

Assuming that you are running IIS 8 or above, you can use Server Name Indication to host multiple sites on the same IP address under SSL.

You will need to have a unique HostName for each site - this can be either subdomains of a common domain, distinct domains or if these are only ever accessed within the corporate intranet, you could also use a distinct name for each application, assuming that the entries are within the corporate DNS.

You will need certificates for each of the application names - again, you have different options depending on the hostname style - for example a wildcard certificate for the common domain, a Subject Alternate Names (SAN) certificate listing the distinct domains, a self signed certificate with the internal names (this later would need to be deployed out to all the client machines otherwise they will warn users not to trust the certificate), or distinct certificates for each application.

Finally, within IIS for each site you add an "https" binding - if you are running IIS 8 you'll need to select a wildcard or SAN certificate before you can add a hostname, on later versions (certainly IIS 10) you can add a hostname and select "Requires Server Name Indication" before selecting the certificate

IIS 8 Adding https site binding

IIS 10 Adding https site binding

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.