SSL Host Headers in IIS 7

SSL Host Headers in IIS 7 allow you to use one SSL certificate for multiple IIS websites on the same IP address. Through the IIS Manager interface, IIS only allows you to bind one site on each IP address to port 443 using an SSL certificate. If you try to bind a second site on the IP address to the same certificate, IIS 7 will give you an error when starting the site up stating that there is a port conflict. In order to assign a certificate to be used by multiple IIS sites on the same IP address, you will need to set up SSL Host Headers by following the instructions below.

What Type of SSL Certificate Do You Need?

Because you can only use one certificate, that certificate needs to work with all the hostnames of the websites that you use it with (otherwise you will receive a name mismatch error). For example, if each of your IIS 7 websites uses a subdomain of a single common domain name (like in the example below), you can get a Wildcard Certificate for *.mydomain.com and it will secure site1.mydomain.com, site2.mydomain.com, etc.

If, on the other hand, your IIS 7 sites all use different domain names (mail.mydomain1.com, mail.mydomain2.com, etc.), you will need to get a Unified Communications Certificate (also called a SAN certificate).

Setting up SSL Host Headers on IIS 7

  1. Obtain an SSL certificate and install it into IIS 7. For step-by-step instructions on how to do this, see Installing an SSL Certificate in Windows Server 2008 (IIS 7.0).

    Install SSL Certificate into IIS 7
  2. Once the certificate is installed into IIS, bind it to the first site on the IP address.

    Bind the SSL Certificate to the first site on the IP address
  3. Open the command prompt by clicking the start menu and typing “cmd” and hitting enter.
  4. Navigate to C:\Windows\System32\Inetsrv\ by typing “cd C:\Windows\System32\Inetsrv\” on the command line.
  5. In the Inetsrv folder, run the following command for each of the other websites on the IP address that need to use the certificate (copy both lines):

    appcmd set site /site.name:"<IISSiteName>" /+bindings.[protocol='https',bindingInformation='*:443:<hostHeaderValue>']

    Replace <IISSiteName>  with the name of the IIS site and <hostHeaderValue> with the host header for that site (site1.mydomain.com)

    Run AppCmd to bind the other sites to port 443 using the same certificate
  6. Test each website in a browser. It should bring up the correct page and show the lock icon without any errors. If it brings up the web page of the first IIS site, then SSL Host Headers haven’t been set up correctly.

If you need to set up multiple site to use a single SSL certificate on IIS 6 or Apache, see How To Configure SSL Host Headers in IIS 6. For more information about SSL Host Headers in IIS 7 see IIS 7.0: Add a Binding to a Site and SSL certificates on Sites with Host Headers.

 Digg  del.icio.us  Reddit

Posted on February 26, 2009
Showing comments 1 to 20 of 37 | Next | Last
VoxVote
Posts: 31
Comment
Hurray, it worked - finally a descent article - IIS 7.5 - Wildcard SSL - 1 fixed ip
Reply #37 on : Wed February 26, 2014, 10:31:27
When reading above comments, I thought, peace of cake, and yes, after some sweat and struggle, everything set up as needed.

Why was my not click and go: (this might help others as well)
- First of all the wildcard * in bindingInformation='*:443:sub1.yourdomain.com']
I had to change this to my dedicated / fixed IP. Created on first site, and on other sub sites.
- Also, the biggest problem was: The wrong certificate was automatically assigned. After removing the server certificate and installing it again, everything worked like a charm.

Thanks!
Vincent van Witteloostuyn
VoxVote
The Netherlands
Jace
Posts: 31
Comment
Help install another SSL on the same IP
Reply #36 on : Sun February 02, 2014, 10:30:42
Hi,
2 sites in 1 IP (www.test.com & try.xxx.com)

A single SSL was already installed for www.test.com, now we want to install another SSL for try.xxx.com. would this be possible?

Sorry really new with IIS, btw we are using IIS 7.

Please help!

Thanks in advance…
Emrah
Posts: 31
Comment
thank you
Reply #35 on : Fri December 27, 2013, 08:03:35
With lots of thanks from Istanbul, Turkey. I spent almost one day for this issue. And now, everything is ok. My www site and subdomain site are both working on the same SSL certificates that I installed IIS
Arnold
Posts: 31
Comment
Super article
Reply #34 on : Wed July 24, 2013, 13:05:51
yes you should receive a statue and a medal
Nate
Posts: 31
Comment
Removing binding using Wildcard SSL Question
Reply #33 on : Wed January 16, 2013, 17:17:59
Is it possible to just Delete the Site and then add it back in to remove the SSL binding from it? Or will this also affect other sites using the same SSL Wildcard Certificate?
Jeff
Posts: 31
Comment
Another answer to Savas
Reply #32 on : Wed December 12, 2012, 15:15:58
Savas, try this:
Delete all bindings.
Follow step 2 above using a placeholder domain.
The placeholder domain should have one file: default.asp/default.aspx with a warning like "this site is off".
Then follow step 3 for all the sites that have SSLs.
Then https://Nosslinstalledsite.com and others will redirect to your placeholder domain with the warning.
Or you can code the default doc to read the SERVER_NAME variable and redirect to the non-SSL version of whatever site they requested.
Luis Perez
Posts: 31
Comment
Use this UI
Reply #31 on : Thu September 20, 2012, 13:03:11
I had to assign host names to SSL sites so often that I ended up creating a UI for it. It looks and feels just like the IIS UI except that it allows you to assign host names to SSL sites.

You can find it on my blog at simplygoodcode.com

Great article, thanks!
Dbo
Posts: 31
Comment
Answer to Savas issue: blocking SSL
Reply #30 on : Mon September 03, 2012, 11:05:31
Answer to Savas issue: blocking SSL... Look into URL Rewrite extension download from Microsoft for IIS.
Mathias
Posts: 31
Comment
different cert for hostheaders
Reply #29 on : Wed August 29, 2012, 01:54:40
Hi,
I have 2 domains (www.domain1.com, www.domain2.com). For both I have a separate certificate. Both domains have the same IP, but a different hostheader. How can I add https with cert1 to domain1 and https with cert2 to domain2 (on the same IP)? Is it possible?
regards
Mathias
frederic
Posts: 31
Comment
watchout when removing binding
Reply #28 on : Thu July 19, 2012, 09:55:03
If you want to remove binding for a site using your wildcard SSL certificate, the only method we found that does not destroy all iis configuration, is to open the applicationHost.config file using notepad, and remove the 443 binding line manually. If you use the iis console, or any script method (that calls the DLL used by the console), you will lose ALL your wildcard https bindings links. Binding will still be there but they are not working.
Doug
Posts: 31
Comment
ssl on IIS
Reply #27 on : Thu June 14, 2012, 16:45:04
if the websites are load balanced you can create them to use different ports. But you'll need to configure the networking correctly. Then you can install the certs for each site without other issues.
Matthieu
Posts: 31
Comment
Why no host header in first site
Reply #26 on : Thu May 03, 2012, 11:24:13
Really great post, very helpful!

One question though: why don't you specify a host header through the UI when you setup the first site?
This would avoid the problem that Savas reports, ie. having non-ssl sites redirected to the first ssl site, don't you think?
fuad
Posts: 31
Comment
correct command --->
Reply #25 on : Thu April 12, 2012, 13:20:31
The correct command for IIS7 is:
appcmd set site /site.name:"my site"/+bindings.[protocol='https',bindingInformation='*:443:my.site.com']
Robert
Posts: 5
Comment
Re: Blocking SSL to showup on other sites.
Reply #24 on : Fri March 02, 2012, 10:11:02
Hi Savas,

Until SNI is fully supported, there is no way to stop that from happening. The best you could do it add some custom code to the SSL site that checks what URL was typed in and redirects to the right URL.
Savas
Posts: 31
Comment
Blocking SSL to showup on other sites.
Reply #23 on : Thu March 01, 2012, 01:30:11
I have several sites hosted on the server, all sharing the same ip address. And have only one SSL sertificate installed for one site.

My problem is:
The site that has ssl installed is: sslinstalledsite.com
so https://sslinstalledsite.com shows up correctly.

but if anyone types https://NOsslinstalledsite.com, the browser opens up https://Nosslinstalledsite.com, but shows the content of sslinstalledsite.com

Is there a way to stop this?
James Blackman
Posts: 31
Comment
Worked for me - great!
Reply #22 on : Thu February 23, 2012, 15:51:03
Thanks for this. Was pulling my hair out trying to configure this in IIS7.5

:)
Z
Posts: 31
Comment
Multiple domain name bindings
Reply #21 on : Tue January 03, 2012, 21:43:36
Whats the command line syntax for IIS7 to add multiple domain names for the same binding? For example, in IIS6 we would just separate each domain with a space like this:

cscript.exe adsutil.vbs set /w3svc/1/SecureBindings ":443:www01.domain.com" ":443:www02.domain.com"
Goycolea
Posts: 31
Comment
missing
Reply #20 on : Fri August 12, 2011, 13:09:52
for those that have their HostHeader Blocked for writing need to go to:

Launch the Microsoft Management Console (MMC)
Select Start –> Run
Type in “MMC” and hit enter
From the console, select File –> Add / Remove Snap-in
Select Certificates from the Add / Remove dialog
Select Computer Account when prompt for which certificates the snap-in will manager.
Select Local Computer when prompted
Click OK to add the Snap-in to the MMC
Locate your SSL certificate
For self-signed (SELFSSL), look in Personal
For installed / purchased, look in the appropriate folder the certificate was originally installed in
Right click on the certificate and select properties
Edit the Friendly Name field so the name starts with an *

everything else is ok on this tutorial, great job !!

but is important tha the friendly name starts with an * or else you won't me able to write your host header.

Goycolea
jonhos
Posts: 31
Comment
Excellent
Reply #19 on : Tue August 09, 2011, 15:27:02
Great Post, still needing this in 2011

MS botched this part, glad you got it figured out
Robert
Posts: 5
Comment
Re: Using separate SSL Cert for subdomain (non-wildcard)
Reply #18 on : Mon August 01, 2011, 22:32:19
Hi Glenn,

You can't use two different SSL certificates with just one IP address. If you need to use two separate certificates, you'll need to have a unique IP for each site and then just install the certificates like normal (you won't need to set up SSL Host Headers)
Showing comments 1 to 20 of 37 | Next | Last

Write a comment


If you have trouble reading the code, click on the code itself to generate a new random code.
Security Code:
 
Post Comment