SSL for windows IIS

Just so other understand.. the binding of an asterisk or "All Unassigned" is more ambiguous than an explicit IP address. The host field in your binding screen is for a DNS name that would be used in a host header HTTP field. The IP address gets you to said computer and the IIS site instance you are on. The host value then goes with what is on SSL bound there (see Subject Alternative Name) field for what your SSL covers. When you get to IIS in Windows Server 2012 R2 or higher, you also have a check box for [ ] Require SNI. SNI is an extension to the TLS protocol to allow the host name in a URL to be exposed to the TLS layer so when the secure connection is being set up and trying to make a match for an SSL Certificate, it can pick from a list. Prior to this point, there is a need to have 1 IP per 1 SSL. You couldn't bind more than one SSL per web site instance. In my environment, I assign one public-IP per website instance and make the https entry match on the IP address and the SSL. I don't fill in host header blank and don't bind two SSLs because I still have Windows 2008R2. Over on Linux, CentOS 7, apache 2.4.something where I have one public IP address to a server, the order that configuration files are loaded matters because the first hostname (ServerName or ServerAlias) that it comes across and satisfies the match is as far as it goes. What this means is that the most specific entries have to appear before less specific entries. What I am saying is that www.example.com has to come before *.example.com if you want a site for www.example.com be found. No idea how this plays out on IIS with host values. Just offering it in case it helps.

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Ravishankar N6y ago
Hi Aruljothy,

Check out this,

https://community.spiceworks.com/topic/2188750-iis-https-site-with-certificate-should-i-set-an-ip-address-for-the-binding
Dipa Mehta6y ago
Just so other understand.. the binding of an asterisk or "All Unassigned" is more ambiguous than an explicit IP address. The host field in your binding screen is for a DNS name that would be used in a host header HTTP field. The IP address gets you to said computer and the IIS site instance you are on. The host value then goes with what is on SSL bound there (see Subject Alternative Name) field for what your SSL covers. When you get to IIS in Windows Server 2012 R2 or higher, you also have a check box for [ ] Require SNI. SNI is an extension to the TLS protocol to allow the host name in a URL to be exposed to the TLS layer so when the secure connection is being set up and trying to make a match for an SSL Certificate, it can pick from a list. Prior to this point, there is a need to have 1 IP per 1 SSL. You couldn't bind more than one SSL per web site instance. In my environment, I assign one public-IP per website instance and make the https entry match on the IP address and the SSL. I don't fill in host header blank and don't bind two SSLs because I still have Windows 2008R2. Over on Linux, CentOS 7, apache 2.4.something where I have one public IP address to a server, the order that configuration files are loaded matters because the first hostname (ServerName or ServerAlias) that it comes across and satisfies the match is as far as it goes. What this means is that the most specific entries have to appear before less specific entries. What I am saying is that www.example.com has to come before *.example.com if you want a site for www.example.com be found. No idea how this plays out on IIS with host values. Just offering it in case it helps.