Ssl – IIS 7.5 Unable to use self signed certificate on a per web site basis for https binding sharing port 443

To call out the bits, this is different from IIS6 and earlier. In IIS 6, the metabase contained the socket, the certificate hash associated with the socket, and so on. In 7, the IIS config just contains a socket (a.b.c.d:443) and lets the OS worry about the certificate management stuff on that socket. (Through the GUI, it's designed to look roughly how it used to). The rule is: you can only have one certificate bound to one socket.

IIS:

In IIS 7, IIS doesn't actually care about the certificate binding. I know, like, gasp, right?

In IIS7, all the IIS configuration does is tie IIS to a specific socket (IP + port). That's it. Makes the configuration much more portable between boxes when you don't need to uniquify the certificate hash on each one.

IIS config is managed using APPCMD or {insert IIS 7 management tool of choice here}, by creating a binding for the site to a socket.

OS:

The OS layer takes over control of the SSL part, so you use NETSH to associate a certificate with a particular socket.

This is done through NETSH.

Sukesh posted a guide to both bits a long time ago, and it's still valid: https://stackoverflow.com/questions/591597/how-to-assign-a-ssl-certificate-to-iis7-site-from-command-prompt

Figured it out: SelfSSL7 /Q /T /I "Default Web Site" /N cn=Machine Name;cn=localhost

This registers both the machine name and localhost in the cert