Ssl – Configure multiple websites in IIS 10 for https

iisssl

I want to configure 3 websites in IIS 10, all with https bindings only, using 3 separate domains and SSL certificates. I know I have to configure the https binding for each site on a different port, but is there a way to do this so the port does not have to be specified when accessing the website, and so it works on restricted networks that only allow port 443 traffic?

https://www.mywebsite1.com default 
https://www.mywebsite2.com instead of https://www.mywebsite2.com:444
https://www.mywebsite3.com instead of https://www.mywebsite2.com:445

Best Answer

You can use the same port number, but you must enable the option called "Requier Server Name Indication" in the Binding of your website and enter the hostname :

Related Solutions

Ssl – IIS 7.5 Unable to use self signed certificate on a per web site basis for https binding sharing port 443

This is not possible.

The TechNet forum post you linked involves trying to set up multiple sites on the same wildcard certificate on the same port, which is definitely possible.

However, using two distinct, different certificates on the same port as you are attempting falls into the realm of requiring TLS Server Name Indication. No current version of IIS supports this.

Ssl – SNI and wildcard SSL certificates on the same server with IIS

Baris is right! The SSL certificate configured on an IP:PORT binding (example: 100.74.156.187:443) always takes precedence in http.sys! So the solution is as follows:

Do not configure an IP:443 binding for your wildcard-fallback-certificate but configure a *:443 binding (* means "All Unassigned") for it.

If you have configured your wildcard certificate on the Azure Cloud Service SSL endpoint (as i have) you have to change the SSL binding created by the Azure Cloud Service Runtime (IISconfigurator.exe) from IP:PORT to *:PORT. I am calling the following method in OnStart of my web role:

public static void UnbindDefaultSslBindingFromIp()
{
    Trace.TraceInformation(">> IISTenantManager: Unbind default SSL binding from IP");
    using (var serverManager = new Microsoft.Web.Administration.ServerManager())
    {
        try
        {
            var websiteName = string.Format("{0}_Web", Microsoft.WindowsAzure.ServiceRuntime.RoleEnvironment.CurrentRoleInstance.Id);
            var site = serverManager.Sites[websiteName];
            var defaultSslBinding = site.Bindings.Single(b => b.IsIPPortHostBinding && b.Protocol == "https");
            defaultSslBinding.BindingInformation = string.Format("*:{0}:", defaultSslBinding.EndPoint.Port);
            serverManager.CommitChanges();
        }
        catch (Exception ex)
        {
            Trace.TraceError(ex.ToString());
        }
    }
}

The following screenshot shows a working configuration of our cloud service. Please don't be confused about the non-standard ports. The screenshot is from the emulated cloud service.

working IIS configuration

One further thing to mention: Do not change all bindings to * because the HTTP (port 80) binding only works with IP:PORT binding in the deployed cloud service. Something else is bind to IP:80 so *:80 does not work because * stands for "all unassigned" and the IP is already assigned somewhere else in http.sys.

Best Answer

Related Solutions

Ssl – IIS 7.5 Unable to use self signed certificate on a per web site basis for https binding sharing port 443

Ssl – SNI and wildcard SSL certificates on the same server with IIS

Related Topic