Ssl – Setting up default SSL site on IIS8

iis-8snissl

I have setup few websites on IIS8 all using the same wildcard SSL certificate. Some of the sites need to be accessible to older browsers and operating systems, therefore I cannot use the "Require Server Name Indication" option.

Since SNI is not supported by all devices, IIS is showing the following alert:

"No default SSL site has been created. To support browsers without SNI capabilities, it is recommended to create a default SSL site."

How do I create a default SSL site? The closest article I found is not very clear, and I have the feeling that there must be an easier solution.

Server details: Windows Server 2012, IIS8, One external IP address

Best Answer

You could chose any of the websites hosted in IIS and uncheck SNI (Server Name Indication there. Check this below

enter image description here

Solution 1: downgrade to the latest stable

Solution 2: edit `listen.conf`

Replace Listen *:443 (or Listen 443 according to your setup) with Listen *:443 http

Credit

Ssl – SNI and wildcard SSL certificates on the same server with IIS

Baris is right! The SSL certificate configured on an IP:PORT binding (example: 100.74.156.187:443) always takes precedence in http.sys! So the solution is as follows:

Do not configure an IP:443 binding for your wildcard-fallback-certificate but configure a *:443 binding (* means "All Unassigned") for it.

If you have configured your wildcard certificate on the Azure Cloud Service SSL endpoint (as i have) you have to change the SSL binding created by the Azure Cloud Service Runtime (IISconfigurator.exe) from IP:PORT to *:PORT. I am calling the following method in OnStart of my web role:

public static void UnbindDefaultSslBindingFromIp()
{
    Trace.TraceInformation(">> IISTenantManager: Unbind default SSL binding from IP");
    using (var serverManager = new Microsoft.Web.Administration.ServerManager())
    {
        try
        {
            var websiteName = string.Format("{0}_Web", Microsoft.WindowsAzure.ServiceRuntime.RoleEnvironment.CurrentRoleInstance.Id);
            var site = serverManager.Sites[websiteName];
            var defaultSslBinding = site.Bindings.Single(b => b.IsIPPortHostBinding && b.Protocol == "https");
            defaultSslBinding.BindingInformation = string.Format("*:{0}:", defaultSslBinding.EndPoint.Port);
            serverManager.CommitChanges();
        }
        catch (Exception ex)
        {
            Trace.TraceError(ex.ToString());
        }
    }
}

The following screenshot shows a working configuration of our cloud service. Please don't be confused about the non-standard ports. The screenshot is from the emulated cloud service.

working IIS configuration

One further thing to mention: Do not change all bindings to * because the HTTP (port 80) binding only works with IP:PORT binding in the deployed cloud service. Something else is bind to IP:80 so *:80 does not work because * stands for "all unassigned" and the IP is already assigned somewhere else in http.sys.

Best Answer

Related Solutions

Apache SSL – Fix ‘Server Should Be SSL-Aware but Has No Certificate Configured’ Error

Solution 1: downgrade to the latest stable

Solution 2: edit listen.conf

Ssl – SNI and wildcard SSL certificates on the same server with IIS

Related Topic

Solution 2: edit `listen.conf`