How To Configure SSL Host Headers in IIS 6

If you need to set up SSL Host Headers for IIS 7 instead of IIS 6, see SSL Host Headers in IIS 7.

Because of the way that the SSL protocol works, it is normally necessary to have a unique IP address for each SSL certificate that you are using. This is because the host header information that tells the server which website to serve up and therefore which SSL certificate to use is encrypted and can't be unencrypted unless it knows which SSL certificate to use. It's like the "chicken and egg" problem. The Apache web server documentation explains the problem clearly.

If you have to use the same IP address for multiple sites, one simple solution is to just use different port numbers. For example:

https://site1.mysite.com
https://site2.mysite.com:8081
https://myothersite.com:8082

But doing it this way requires that you always visit the site using the port number and always reference it in links with the port number.

There is a more elegant method, if you have IIS 6.0 or later. That method is to use SSL Host Headers.

With SSL Host Headers, you will essentially use one SSL certificate for all of the sites that use SSL on a particular IP address. For this to work then, you will need to have either a Wildcard certificate or a Unified Communications Certificate. If all of the websites are subdomains of one domain name (e.g. site1.mysite.com, site2.mysite.com), you can use a Wildcard certificate. If there are completely different domain names (e.g. mysite.com, myothersite.com), you will need to use a Unified Communications Certificate.

The first step, if you haven't already done it, is to set up each of the websites with normal http host header values. You can do this by clicking the Advanced button next to the IP address when editing each website's properties in IIS. Just click the Edit button and add a domain name as the host header value.

Next, you will need to create a pending request on one of the websites and order the Wildcard or UC certificate from the certificate authority of your choice. Once you have a Wildcard or UC certificate that will work for all of the hostnames that are on the same IP address, you need to use it to complete the pending request on the website that you created it on. Then you just need to configure the SecureBindings metabase property on each of the other sites so it contains the host header name of the site. To do so, follow these steps:

  1. Click Start, click Run, type cmd in the Open box, and then click OK.
  2. Navigate to your IIS scripts directory by typing cd C:\Inetpub\AdminScripts Adjust the path to where the adsutil.vbs file is, if necessary.
  3. Type the following command at the command prompt:

    cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:<host header>"

    <host header> is the host header value for the Web site (www.myothersite.com). <site identifier> is the IIS site ID displayed when looking at all the websites in IIS.

Find the site identifier by clicking on Web Sites in IIS

Type the command

Run that command for each of the websites that need to use that certificate. They will then use the same certificate that was install to the first site on the IP. A few more notes about SSL Host Headers in IIS 6 can be found here.

Apache

This same basic functionality (using a single certificate for multiple websites on the same IP address) can be acheived in Apache by simply adding this line to your Apache configuration file:

NameVirtualHost 192.168.1.1:443

This essentially instructs Apache to use the SSL certificate in the first Virtual Host for that IP address on all the other virtual hosts for the same IP address. You just need to make sure to use a certificate that will cover the names of all the sites as discussed above. View a sample configuration file demonstrating this.

Different Certificates on the Same IP address

It is generally not possible to use different SSL certificates on the same IP address. However, a modification to the SSL protocol, called Server Name Indication, allows the domain name to be passed as part of the TLS negotiation allowing the server to use the correct certificate even if there are many different sites using different certificates on the same IP address and port. Server Name Indication is supported by most modern web browsers but only a few web servers, such as Apache, Lighttpd, and Nginx, support it using special add-ons.

If you're feeling adventurous you can try using different certificates on the same IP address with Apache using one of these tutorials:

Originally posted on Sat Dec 8, 2007

Comments (43)

  1. Eyal:
    Jun 12, 2013 at 09:09 AM

    I have two websites: 1. EN.2send.co.il 2. 2send.co.il Both are working fine with HTTP But when using in browser HTTPS the EN version loads for both of them. I am using wildcard SSL with host headers configuration as described you your guide. I cannot find the solution anywhere any idea? Thanks.

  2. Robert:
    Jul 26, 2012 at 02:10 AM

    I have tried to renew a certificate on IIS. after adding the cert to the MMC when i restart the cert is renewed on the console of IIS but the URL still shows the old cert. When i remove the old cert from the MMC then the URL becomes inaccessible giving " page cannot be fund error"

  3. Robert:
    Jan 04, 2012 at 08:45 AM

    Hi Z, I'm not 100% sure, but I think you just need to renew the cert on one site and then run the csxript.exe commands for each of the other sites again.

  4. Z:
    Jan 03, 2012 at 07:31 PM

    What is the process of renewing a wildcard SSL certificate? I have 5 websites in IIS6 all of which are using SSL hostheaders. Initially when I set it up last year I assigned the certificate to the first site and then ran the script for all sites (including the first) and things were working fine. Now its come time to renew - do I just renew the same initial first site and then everything else will remain working? Anything else? Thanks!

  5. Bryan:
    Oct 25, 2011 at 11:14 AM

    Thanks so much, this is a very straightforward and incredibly useful solution. I talked to 5 different GoDaddy techs, and not one knew this was possible. You saved us from installing 20 additional IP's on our server. Cheers!

  6. Robert:
    Apr 13, 2011 at 10:06 AM

    Great article, been really helpful. However I want to create a certificate request from IIS that contains a list of host headers in it. So my cert should contain www.mysite.com and www.myothersite.com (one in the common name and the other in the SAN extension). I have my own CA hierarchy so I can issue the cert but it has to be requested with all the host values it represents in the first place. I've followed your guide upstairs and configured the two host values against the same ip address. I then use the IIS snap-in to create a new cert request (I've deleted the old one so as to have a clean slate) and when I use openssl to view that request I can see that it does not have the SAN extension in there - essentially the request only requests for the first web site (cn) but not for the other one. Is it possible to get IIS to do this? Your article talks about UCCs but not how I can get IIS to generate a request for one. Any ideas? Thanks Martin

  7. žoge:
    Mar 30, 2011 at 04:46 AM

    Excellent advice fixed my problem after my boss almost hang me, since the old settings suddenly stoped working:)

  8. sdpcrAdmin:
    Mar 10, 2011 at 03:49 PM

    Hi, Thanks for posting this. The instructions are straight forward and the solution worked great for our wild card certificates! Thanks! SDPCR

  9. jason:
    Aug 12, 2010 at 02:49 PM

    hey guys, i have a UCC cert and i used the tutorial to setup ssl host headers, but it defaults to the "any" ip i need to define the SSL host headers AND use a specific IP possible in IIS6?

  10. ssllogic:
    May 28, 2010 at 03:29 AM

    Hi, I have purchased an SSL Certificate from ssllogic.com and i am struggling to maintain it out there as i am not much familiar about SSL Certificates

  11. Robert:
    May 07, 2010 at 08:44 AM

    Hi Dony, You can currently only have one certificate per IP. You either need to get another IP address or get a Unified Communications certificate that includes the names of both sites and follow the instructions on this page.

  12. Dony Jose:
    May 06, 2010 at 03:24 AM

    Hi, I have an issue in the ssl configuration. I have 2 websites, say http://domain1.com and http://domain2.com, and both the websites has its own unique SSL certificates also. I need to know whether I can put this two certificates and website in same server. Regards, Dony Jose

  13. Swathi:
    Apr 28, 2010 at 10:20 AM

    Thanks for posting a very useful information. However i did something and now whole webserver is down. IIS has SSL certificate already installed on it. I was trying to configure the SecureBindings metabase for SSL host header to point to “exact” host name for the site so that it shows up in service base address. - It was accessing private domain address instead of public one I was trying to change the URL in wsdl from https://Privatedomain.com/ to https://public.domain.com/ I ran the following script cscript.exe adsutil.vbs set /w3svc/1/SecureBindings ":443:public.domain.com" After that I have restarted IIS and tried running websites, with or without SSL, it gives me "Internet Explorer cannot display the webpage" I realize now that i used "1" in place of which is for default website. Please help me in fixing this issue. I appreciate any help. Thanks & Regards, Swathi

  14. Robert:
    Apr 27, 2010 at 05:35 PM

    Hi Terry, If both of the domains are on the same external IP address, you need to get one certificate that has both names in is (a UC certificate). You could also put one of the sites on another IP address and use two certs.

  15. Terry:
    Apr 27, 2010 at 11:00 AM

    Hello,I need to have SSL configured for two DIFFERENT domain names and cannot figure out how. I read through the posts but ... Site 1 = support.123.com 10.0.0.1 Site 2 = support.ABC.com 10.0.0.2 I have configured two IIS sites and applied SSL certs to each according to their domain. When I hit the web site https://support.123.com all works as expected. The other site gives the warning to continue. I have run the following commands and when I use the GET statement the results are correct. cscript.exe adsutil.vbs set /w3svc/2/SecureBindings ":443:support.123.com" cscript.exe adsutil.vbs set /w3svc/1239553289/SecureBindings ":443:support.ABC.com" Any help will be greatly appreciated.

  1. 1
  2. 2
  3. 3




Allowed tags: <b><i><br>Add a new comment: