Care, Share and Grow!

Hi Aloy,

I don't see a reason as to why it should fail. Have you checked with the vendor which issues the wildcard cert, in this case it seems Verisign. Also before that, have you checked going through IIS certifticate wizard to request for a new certificate and see if that fails too. Let me know. Also where exactly do you see the error.

Hi John, thanks for your response.

Not sure if I got your question correctly.

If you want to see the listing of a website with its corresponding identifier, go to IIS manager console, select Web Sites (at the global level), and then on the right pane you will see the columns: Description (which shows the friendly name) and Identifier column (which shows the identifier corresponding to the website on IIS 6.0).

Or else, Right click on a website -> Properties -> Web site.

Under enable Logging section, click on Properties -> at the bottom you will see Log file name, which will have the identifier for the website in the format W3SVC<ID>\exyymmddhh.log.

Not sure if this what you had in mind. Let me know if you are looking for some scripts etc to get the friendly name and its corresponding identifier. You can check this link to run a VB Script from cmd prompt http://blogs.msdn.com/david.wang/archive/2005/07/13/HOWTO_Enumerate_IIS_Website_Configuration.aspx

Hope this helps.

Thanks!

Hi sg, thanks.

Regarding your concerns,

a). I wonder why users will get an IE warning. Users should not get a security alert in IE at all if you have used the Common Name while requesting the certificate through the IIS wizard to use *.abcd.com etc.

If your wild card cert shows *.abcd.com in the "Issued to" section, then when you access a site like test.abcd.com, mail.abcd.com etc you should not get an alert at all. Let me know if we are on the same page and I will try to clarify it more clearly.

b). Yes, 3rd parties like VeriSign etc do issue wildcard cartificates.

Sg, you are right, IE 7 shows a more esoteric alert :-), that's true. But again, if we have the SSL cert correctly set, IE won't get a chance to prompt with an alert to the end users.

Anyways, coming back to your other question, yes, the user-created web sites have long random site identifiers. It's actually based on random sequence and doesn't have any ill-effects as such. Certain softwares like SharePoint and Symantec do check for next available ID that can be used etc.

You can set the site identifier of your own choice by following the command below:

C:\Inetpub\Adminscripts> Cscript adsutil.vbs move w3svc/<existing_Identifier>   w3svc/<new_identifier>

e.g.

>cscript adsutil.vbs move w3svc/12345678  w3svc/10

Your website may get stopped after this, so ensure you start the website again after executing this command.

Hope this helps.

Hi Joe,

I am not sure I got what you really asked for. Sorry.

Let me try answering what i understood.

If you have WSUS without SSL as a web site on the server and if you are trying to install certificate for another web site on the same server it would NOT impact the first site. Your WSUS is listening on port 80 (by default unless you changed the port) and SSL enabled site over https listens on port 443 (by default unless modified).

Yes, you can copy and install the wild card cert from the old server to this server for numara product site.

Let me know if I missed any of your requirements.

Hope this helps!

Hi Joe,

Guess we can talk to understand better about the problem in hand.

Please email me your number (if you are in US) at xxxxxxxxxxxxxx.

People often enquire questions/concerns related to SSL wildcard cert etc. Questions that come directly to me via email and is not posted in this blog/comments section, I will try to add them here in case it is of value to people having similar questions/concerns around the subject. Here is the first one:

====================================

Hi Saurabh,

I have just found your article (Wildcard SSL certificate in IIS 6.0, Windows 2003 Sp1 and above) and I was wondering that maybe you could help me to find some answers.

We just purchased an wildcard certificate and I'm having some issues on setting it up on our IIS server.

Currently I have the same structure as the one from your blog:

The problem is that this is a production server and I don't want to screw things up. That's why I have these questions:

1. Do I have to get rid of the existing Host Header Value before I do the binding?

ans: > No, you don’t have to remove the host header entries.

2. Can the Test2 (for example) be accessed by http after I do the binding for the main one (www.test.com)

(the reason why I'm asking this would be because I don't want to do the binding for all existing subdomains yet)

ans: > Yes you can access any other site including www.test.com over HTTP without issues. The problem arises when you try to access a site over SSL after installing the cert and not having the right bindings.

3. When I do the binding for www.test.com does it kick off the customers that are on the other websites (subdomains)?

ans: > No, it won’t kick off customers who are on the other sites/subdomains. Users get kicked off if by any chance you recycle the IIS worker process, which won’t occur here.

Thanks,

Adrian Mic

Hi Manish,

You need not create subdomains unless it is required in your web site architectures. what i mean is if *only* you have sites in the form www.microsoft.com, mail.microsoft.com etc you need to have subdomains and hence the need fro Wildcard certs.

If you want to have such a structure for your sites you can add host headers for these sites in the IIS mmc in the form of xxx.domain.com where xxx is www, mail etc. These are subdomains. Let me know if this is what you were looking for.

Hi Manish,

If you just want to secure www.mail.test.com you need not even have a wild card certificate. Wild card certificate is recommended when you want a certificate to bind to *multiple* sites.

Anyways, here you just need to install this certificate as usual on the www.mail.test.com and don't install the certificate on any other sites (since they are not required to be secured).

Access www.mail.test.com over SSL and you should be good.

Chill!

Based on what I understand you want to access the same web site with two different URLs and ensuring that the SSL connection doesn't throw a security alert for either of them. If this is what you have in mind then refer to this article http://support.microsoft.com/kb/931351.

[I wish they could have used a better title for this article]

You need to add Subject Alternative Names (SANs) corresponding to as many URLs as you have for the same site. Let me know if this is what you need.

tnx!

Stephan,

Yes you can use Wild card certificate but what is the logic behind it? Wildcard was suggested to ensure we could run multiple SSL based sites on the same server using the same cert. If you are planning to deploy different sites (although with same end-domain name) on different servers there are no restrictions which would have prompted users to go for Wildcard SSL in the first place. They are independent certs even though they are wildcard certs when deployed on different machines.

Yes, I don't see it as a good option for the other site.

Wildcard should be used for multiple sites wherein they have the same end domain name (like *.test.com here) and they should have at least some different name for the prefix in the URL, like www, mail, etc.etc. In your case I don't see any prefix in the host header for the 2nd website which seems to be just test.com.

My best bet would be to have something added to the beginning of the 2nd website, like <abcd>.test.com and then add the secure binding for it like ":443:<abcd>.test.com".

Okay, so in that case wherein both the URLs are pointing to the same site you will get Bad Request error as expected because you have the securebindings mapped to one of these Urls. If you did not have securebindings mapped at all to any of the urls both the urls should have worked.

To add multiple securebindings entry to the same website for different urls here is the command you need to try:

Cscript adsutil.vbs set w3svc/<SiteID>/SecureBindings ":443:adv.contoso.com"

":443:sales.contoso.com"

In your case run this cmd and you should be good.

cscript adsutil.vbs set w3svc/<SiteID>/securebindings ":443:www.test.com" ":443:test.com"

Np, yes you can rerun the same command with the modified parameters.