SSL Server name mismatch how to bypass ie11

iisinternal-dnsssl

We have an app and the really long story short is that things have to be setup this way in order for the rest of the app not fail.

We have a domain

https://server01/AppNet

In IIS the 443 binding is setup to use a cert with:

CN=server02

When I hit the page for

https://server01/AppNet

I get a SSL warning

enter image description here

I found this article

https://superuser.com/questions/522123/how-do-i-get-my-browser-to-ignore-certificate-on-trusted-domain

But would like to avoid the part about:

"Unfortunately, it'll also stop the browser from complaining about address mismatches on every other site you visit, as well. That's less than ideal, but it's the kind of tradeoff you get to make when you use IE."

I have also followed the steps outlined below however still give error

Fix 1 – Install the Certificate

Right-click the “Internet Explorer” icon, then choose “Run as administrator“.

Visit the website, and choose the option to “Continue to this website (not recommended).”.

Click where it says “Certificate error” in the address bar, then choose “View certificates“.

Select “Install Certificate…“.

Select “Next“.

Select the “Place all certificates in the following store” option.

Select “Browse…“.

Choose “Trusted Root Certification Authorities“, then select “OK“.

Select “Yes” when prompted with the security warning.

Select “OK” on the “The import was successful” message

Select “OK” on the “Certificate” box.

This is only for internal network

Is there anything I can add to IIS?

Is there anything I can add to DNS?

Any other work arounds?

Best Answer

If you have access to create your certificates for that server I suggest you create a certificate that includes alternate names that the server may be known as. In that way the browser will automatically resolve the correct name.

From https://blogs.msdn.microsoft.com/varunm/2013/06/18/bind-multiple-sites-on-same-ip-address-and-port-in-ssl/

SAN Certificate (Subject Alternative Name Certificate)

You can setup the wildcard certificate if the domain name for all the sites are same and first level subdomain changes. What if you want to set up the sites which should work on two different domain names, for example, a site with host header as www.testserver1.com and another site with hostheader as www.testserver2.com. In this case Wildcard certificate won’t help you. To resolve this issue we have SAN Certificate.

A SAN cert allows for multiple domain names to be protected with a single certificate. For example, you could get a certificate for myserver.com, and then add more SAN values to have the same certificate protect myserver.org, myserver.net and even myserver2.com or www.example.com.

You can see the domain names in the Subject Alternative Name option in the Certificate

Related Topic