Wildcard SSL certificate in IIS 6.0, Windows 2003 Sp1 and above

Comments

# MSDN Blog Postings » Wildcard SSL certificate in IIS 6.0, Windows 2003 Sp1 and above said:

PingBack from http://msdnrss.thecoderblogs.com/2007/11/17/wildcard-ssl-certificate-in-iis-60-windows-2003-sp1-and-above/

16 November 07 at 11:16 PM

# Noticias externas said:

Here I will be talking about configuring SSL wildcard certificates in IIS 6.0 on Win2k3 SP1 and above

17 November 07 at 4:49 AM

# /dev/null said:

Thanks for sharing this info and making it clear enough for me.  Very helpful, thanks.

08 January 08 at 3:18 PM

# Aloy said:

I am not able to get the wildcard cert. my company is using its own portal to obtain certificate from verisign.

Here is the error i am getting:

Your request contains a dnsName that is incorrectly formatted.

The offending name is: *.subdomain.domain.com

Support Information: 35DB

20 February 08 at 12:52 AM

# Saurabh Singh said:

Hi Aloy,

I don't see a reason as to why it should fail. Have you checked with the vendor which issues the wildcard cert, in this case it seems Verisign. Also before that, have you checked going through IIS certifticate wizard to request for a new certificate and see if that fails too. Let me know. Also where exactly do you see the error.

20 February 08 at 9:15 AM

# John_R said:

Thanks. Your explanations are crystal clear until the csript explanation. My problem is that I don't see any correlation between <site identifier> and the web sites present in IIS Manager. I have run this command to enumerate the web sites:

cscript.exe adsutil.vbs enum_all /P

The above command's output lists my web sites as numbers (e.g. [33430808]) instead of the human-readable names used for them in IIS Manager. How can I get my web sites to list out as something other than numbers via the command line?

25 March 08 at 4:59 PM

# Saurabh Singh said:

Hi John, thanks for your response.

Not sure if I got your question correctly.

If you want to see the listing of a website with its corresponding identifier, go to IIS manager console, select Web Sites (at the global level), and then on the right pane you will see the columns: Description (which shows the friendly name) and Identifier column (which shows the identifier corresponding to the website on IIS 6.0).

Or else, Right click on a website -> Properties -> Web site.

Under enable Logging section, click on Properties -> at the bottom you will see Log file name, which will have the identifier for the website in the format W3SVC<ID>\exyymmddhh.log.

Not sure if this what you had in mind. Let me know if you are looking for some scripts etc to get the friendly name and its corresponding identifier. You can check this link to run a VB Script from cmd prompt http://blogs.msdn.com/david.wang/archive/2005/07/13/HOWTO_Enumerate_IIS_Website_Configuration.aspx

Hope this helps.

Thanks!

25 March 08 at 6:40 PM

# John_R said:

Thanks for your response, which fully answers my question.

Best of luck with your Blog.

26 March 08 at 10:14 AM

# atucker said:

I was wondering, if you wanted to do this is a wildcard certificate required or can you get an SSL certificate for each subdomain you make?

11 April 08 at 3:29 PM

# Saurabh Singh said:

Hi atucker,

Yes, you can definitely get different SSL certificates for each sub-domains. It's up to an individual as to which route s/he wants to take.

Having one wild card cert across all sub-domains will help in the administration purpose, consistency and convenience may be. I hope i understood your question correctly.

11 April 08 at 4:07 PM

# KSI said:

This will only work with a wildcard cert as only one cert is actually served.  So if you are all right with having your users click on the continue button once they are provided with the IE warning then fine it works great.  Still not the best solution for hosting multiple domains.

15 April 08 at 6:09 PM

# sg said:

Saurabh - great article. I read your blog after reading the MS Technet article (http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/596b9108-b1a7-494d-885d-f8941b07554c.mspx?mfr=true) which was not clear about the site identifier to use.

However, as one of the earlier comments - two issues that remain to be solved:

a) users will get IE warning which in IE7 has become more "frightening" for non-tech savvy users - I guess the solution is to specify separate certificates for each domain you want to host.

b) do the commercial third-party certificate authorities issue a wildcard certificate?

08 May 08 at 12:25 PM

# Saurabh Singh said:

Hi sg, thanks.

Regarding your concerns,

a). I wonder why users will get an IE warning. Users should not get a security alert in IE at all if you have used the Common Name while requesting the certificate through the IIS wizard to use *.abcd.com etc.

If your wild card cert shows *.abcd.com in the "Issued to" section, then when you access a site like test.abcd.com, mail.abcd.com etc you should not get an alert at all. Let me know if we are on the same page and I will try to clarify it more clearly.

b). Yes, 3rd parties like VeriSign etc do issue wildcard cartificates.

08 May 08 at 12:44 PM

# sg said:

Hey Sourabh - I meant IE security alert which in IE7 is worded a little too strongly and frightens non-tech users.

One question on the identifier for the websites, I noticed in IIS6 that while system created site such as Default Web Site has identifier 1 and Sharepoint has 2 - the user created ones have a really long number. I wonder how is this number generated and is there a way to manage it.

I also noticed that Symantec Mail Security picked up the next available single digit number whereas the user created sites have anywhere from 6 to 12 digits.

08 May 08 at 11:47 PM

# Saurabh Singh said:

Sg, you are right, IE 7 shows a more esoteric alert :-), that's true. But again, if we have the SSL cert correctly set, IE won't get a chance to prompt with an alert to the end users.

Anyways, coming back to your other question, yes, the user-created web sites have long random site identifiers. It's actually based on random sequence and doesn't have any ill-effects as such. Certain softwares like SharePoint and Symantec do check for next available ID that can be used etc.

You can set the site identifier of your own choice by following the command below:

C:\Inetpub\Adminscripts> Cscript adsutil.vbs move w3svc/<existing_Identifier>   w3svc/<new_identifier>

e.g.

>cscript adsutil.vbs move w3svc/12345678  w3svc/10

Your website may get stopped after this, so ensure you start the website again after executing this command.

Hope this helps.

09 May 08 at 12:03 PM

# Joe said:

Hi

I set up WSUS without https.  Another admin set up our numara help desk on the same server without giving another default site folder in the iis. (I have to click on "default web site" folder / properties / directory security to get to the sever communication opetion)

When I create the certificate how would it impact the wsus?

Any idea if these are statis files? Any idea if I can create another site and move the driectory path to new location?

The numara product was migrated to this wsus server - the old server has it own wild card certification - can I copy/install it to this server?

Thanks

Joe

15 May 08 at 7:34 AM

# Saurabh Singh said:

Hi Joe,

I am not sure I got what you really asked for. Sorry.

Let me try answering what i understood.

If you have WSUS without SSL as a web site on the server and if you are trying to install certificate for another web site on the same server it would NOT impact the first site. Your WSUS is listening on port 80 (by default unless you changed the port) and SSL enabled site over https listens on port 443 (by default unless modified).

Yes, you can copy and install the wild card cert from the old server to this server for numara product site.

Let me know if I missed any of your requirements.

Hope this helps!

15 May 08 at 12:01 PM

# Joe said:

Hi

Both the WSUS site and numara helpdesk site runs on 80 at the moment.

We want to make it ssl.

1)Is it alrite to running both sites on "default web site" space

2)You are saying I can use my current wild card ssl certification on this space

I dont see anything wrong with since the numara site os pointing to an alternate path. Numara has an application pool. I cannot just create 1 site with ssl for my current set up.

Since the root file only shows the ability to addthe server certification - everything under that the server certification option is greyed out.

Thanks for your help. I've copied the old certs.

Any thoughts?

Joe

15 May 08 at 1:30 PM

# Saurabh Singh said:

Hi Joe,

Guess we can talk to understand better about the problem in hand.

Please email me your number (if you are in US) at xxxxxxxxxxxxxx.

15 May 08 at 1:42 PM

# Joe said:

Hi -

My issue is resolved. Thanks for putting this up for IIS

Thanks

Joe

19 May 08 at 8:50 AM

# Saurabh Singh said:

People often enquire questions/concerns related to SSL wildcard cert etc. Questions that come directly to me via email and is not posted in this blog/comments section, I will try to add them here in case it is of value to people having similar questions/concerns around the subject. Here is the first one:

====================================

Hi Saurabh,

I have just found your article (Wildcard SSL certificate in IIS 6.0, Windows 2003 Sp1 and above) and I was wondering that maybe you could help me to find some answers.

We just purchased an wildcard certificate and I'm having some issues on setting it up on our IIS server.

Currently I have the same structure as the one from your blog:

The problem is that this is a production server and I don't want to screw things up. That's why I have these questions:

1. Do I have to get rid of the existing Host Header Value before I do the binding?

ans: > No, you don’t have to remove the host header entries.

2. Can the Test2 (for example) be accessed by http after I do the binding for the main one (www.test.com)

(the reason why I'm asking this would be because I don't want to do the binding for all existing subdomains yet)

ans: > Yes you can access any other site including www.test.com over HTTP without issues. The problem arises when you try to access a site over SSL after installing the cert and not having the right bindings.

3. When I do the binding for www.test.com does it kick off the customers that are on the other websites (subdomains)?

ans: > No, it won’t kick off customers who are on the other sites/subdomains. Users get kicked off if by any chance you recycle the IIS worker process, which won’t occur here.

Thanks,

Adrian Mic

30 May 08 at 6:01 PM

# Manish said:

Hi ,

how i can create sub domain under the existing domain

Thanks,

Manish

08 September 08 at 1:53 AM

# Saurabh Singh said:

Hi Manish,

You need not create subdomains unless it is required in your web site architectures. what i mean is if *only* you have sites in the form www.microsoft.com, mail.microsoft.com etc you need to have subdomains and hence the need fro Wildcard certs.

If you want to have such a structure for your sites you can add host headers for these sites in the IIS mmc in the form of xxx.domain.com where xxx is www, mail etc. These are subdomains. Let me know if this is what you were looking for.

08 September 08 at 2:35 PM

# Manish said:

Hi Saurabh,

now i have create sub domain. the senerio is like below.

i have three site like

www.test.com

www.mail.test.com

www.frm.test.com

know i have bought a wildcard certificate for *.text.com

what i need is to secure the www.mail.test.com only, and remaining site should not be secure by SSL.

hope you get what i need.

Thanks in Ad.

10 September 08 at 1:32 AM

# Saurabh Singh said:

Hi Manish,

If you just want to secure www.mail.test.com you need not even have a wild card certificate. Wild card certificate is recommended when you want a certificate to bind to *multiple* sites.

Anyways, here you just need to install this certificate as usual on the www.mail.test.com and don't install the certificate on any other sites (since they are not required to be secured).

Access www.mail.test.com over SSL and you should be good.

Chill!

10 September 08 at 11:21 AM

# vinnekk said:

Hello Manish,

Great thread. I am not IT person, just curious how it works and one part of process eludes me. Maybe my question isn't right here because this is SSL and my thought is host header / site related. If i should post elsewhere please let me know.

My senerio:

main site = test.com ; home dir = c:\test  IP: 1.2.3.4

subdomain = driving.test.com ; home dir = c:\test\driving IP: 1.2.3.4

My Question:

test.com created as website in IIS

driving.test.com / www.driving.test.com setup as host headers under test.com binding to IP: 1.2.3.4

When browsing to: http://driving.test.com  how does default doc in the c:\test\driving directory get loaded? Is there a step i am missing? Any thoughts are greatly appreciated..

vinnekk

27 September 08 at 3:58 AM

# Colin Wiseman said:

Perfect!  This is exactly what i needed.  Could not find any other site that had that last part with the cscript.

Big thanks!

27 September 08 at 2:17 PM

# Saurabh Singh said:

Hi vinnekk, thanks!

As answered in the other post for your similar comment, if you have multiple host headers pointing to the same web site you can load the contents of this site with any of the host header names. All the host headers here are pointing to the same web site and hence the same content will be loaded.

However, with that said, i see that in the above scenario you are trying to load different content (c:\test\driving) although your URL (http://driving.test.com) is added as a host header to the same web site as http://test.com. http://test.com is pointing to c:\test. Hence content from c:\test will be loaded here and not from c:\test\driving even if you are using driving.test.com.

Host headers are just kind of an ALIAS. If you want to load different contents for two different URLs, you need to ensure they are pointing to two different sites and not to the same site as above in your case.

Hope this helps.

Saurabh

[Also in case you have time go through this post of mine to get a more detailed understanding of host headers etc.

http://blogs.msdn.com/saurabh_singh/archive/2007/08/02/an-area-of-confusion-with-host-header-ip-and-port-combinations-within-iis.aspx]

28 September 08 at 12:56 PM

# Dave Curtis said:

Why do I get this message in the event log?  I have followed all of the required steps for a wildcard cert.  What does the message mean?  Is it referring to my other ssl site?

Thanks for the info.

Dave

Event Type: Error

Event Source: W3SVC

Event Category: None

Event ID: 1113

Date: 10/2/2008

Time: 9:56:43 AM

User: N/A

Computer: WWS10-003

Description:

One of the IP/Port combinations for site '1594238194' has already be configured to be used by another site.  The other site's SSL configuration will be used.  

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

02 October 08 at 2:05 PM

# Saurabh Singh said:

Hi Dave,

If you are using the Wild card cert for the Web sites, and have proper settings for SecureBindings, then you can safely ignore this error. If you are not seeing any issues with accessing your web sites with the correct Certificates installed on them ignore this all together. This is a benign message and is a remnant of days when SSL was not supported on host headers (Pre-SP1 on win2k3).

Hope this helps!

Saurabh

02 October 08 at 2:32 PM

# David Curtis said:

Thank you!  I suspected as much, but it is a fine thing to get a positive response.

I appreciate it.

13 October 08 at 6:08 PM

# Jon Sagara said:

Very nice.  Got my sites working.  Thanks!

27 October 08 at 6:45 PM

# Kashif said:

HI,

I just installed a UCC 5 domains certificate from godaddy onto the servers. After installing "same" certificate on two "hosts", I wasn't able to get the other website to start:

Cannot register the URL prefix 'https://*:443/' for site '123456789'. The necessary network binding may already be in use.

I gave the above method a shot and it seems to be working fine for the time being.

I was just wondering if there is a way to "undo" this change in case something goes wrong.

10 November 08 at 6:10 AM

# Saurabh Singh said:

Hi Kashif,

I guess when you say "the above method" and "undo changes" you mean the command that you ran through adsutil.vbs, correct me if i am wrong. If that's the case, you can undo the changes by deleting the above settings as follows:

To view the current setting:

> cscript.exe adsutil.vbs get /w3svc/1/SecureBindings

To delete the current setting:

> cscript.exe adsutil.vbs delete /w3svc/1/SecureBindings

If before doing the changes it was set to SecureBindings as ":443:" etc. you can revert back to this by setting the old value.

Hope this helps!

10 November 08 at 9:36 AM

# Bill Green said:

Perhaps I missed the answer to my question in the comments (all the comments very helpful though).  I have a single IIS box, but two different sites I need to use SSL with.  I purchased two seperate SSL certs (one for each site).  

Is it possible to use each SSL cert for the seperate sites on the same box without having to buy a wildcard cert?  As with many govt agencies lately, money is tight and I will get no end of grief if I have to spend additional money after buying the two seperate certs?

13 November 08 at 11:11 AM

# Saurabh Singh said:

Hi Bill,

You can use the same cert for multiple websites on the same server provided the sites are specifically bound to *different* IP addresses or *different* ports. They should not be running on "All Unassigned" if you intend to keep the same port number (like default 443). In case you are okay to run the sites on different SSL ports you can use the same IP address (or All Unassigned) for these sites.

Refer to this, http://support.microsoft.com/kb/187504/en-us

Also if using any of the above methods you install the same Cert on multiple sites you will get a security alert because of the hostname mismatch in the SSL transaction over https. You can fix this part by adding Subject alternative Names (SANs) for the certificate while requesting it from the CA. If you are using MS CA refer to this...http://support.microsoft.com/kb/931351

else contact 3rd party CA vendor.

Hope this helps!

13 November 08 at 11:54 AM

# Andy said:

Hi,

I have been using the method here for a wildcard SSL cert in IIS6 for a few months and it works fine.

however, I deleted a subdomain website and then recreated a new website in IIS6 with the "same" home directory on the W2003 server, added my new "different than before" host header: sitename1234.domain.com and added the secure bindings and it works fine.

But, I notice the old URL subdomain still works? I dont know the old sites ID (Identifier as I deleted it) to delete it in DOS, so can I view it or delete old Site ID's? as if not this would be a security threat?

so example, same home directory:

https://site2.domain.com ID 12***** (deleted - not known )

https://site3.domain.com ID 1234567 (new site, same folder in IIS)

both URLs work?

any ideas how to view the old ID binding and to delete it?

Thanks. Andy

13 January 09 at 7:15 AM

# Saurabh Singh said:

Hi Andy,

When you say "But, I notice the old URL subdomain still works? " does that mean you are able to access your old website with the name http://site2.domain.com. If that is the case it could be that you have a DNS/Hosts entry for the host header site2.domain.com which still points to the same server. So even though you have deleted this old site it is actually pointing to your new site and since both of them point to the same physical file path things look fine at the exterior. Hope I am not confusing you.

Also you can open the metabase.xml file from %systemdrive%\WINDOWS\system32\inetsrv in a notepad and search for the old site host header. It may be that a stale entry is still left in there...but I strongly doubt this should allow your site to be accessible from the browser.

I suggest checking again the DNS/hosts mapping for the old site URL. Try a PING to the above URL and see where does it point to. BTW, does it work the same way even without SSL (assuming your site can be accessed without SSL)?

13 January 09 at 4:39 PM

# Andy said:

Hi Saurabh, thanks for your update to my question.

I think it could well be DNS, I will check this and let you know if it fixes my problem.

Thanks, Andy

20 January 09 at 8:08 AM

# Andy said:

Hi,

yes it was a wrong DNS entry.

thanks for your help.

Andy

22 January 09 at 8:22 AM

# felix tjandrawibawa said:

is the comment moderated? - please delete this if it is - just making sure that my last comment was indeed posted.

18 February 09 at 2:22 AM

# DP said:

I have a question, what if I have one website, accessible via 2 names. IE test.domain.com and live.domain.com.  The same site, same identifier, how would I install a cert for both? If I install 1 cert for test.domain.com it throws a cert warning for live.domain.com saying the cert is owned by a different site.  

I assume wildcards won't work because its only 1 site.  How would I got about getting a cert for each URL, so that there is no warning and the user is none the wiser?

20 February 09 at 10:40 AM

# Saurabh Singh said:

Based on what I understand you want to access the same web site with two different URLs and ensuring that the SSL connection doesn't throw a security alert for either of them. If this is what you have in mind then refer to this article http://support.microsoft.com/kb/931351.

[I wish they could have used a better title for this article]

You need to add Subject Alternative Names (SANs) corresponding to as many URLs as you have for the same site. Let me know if this is what you need.

tnx!

20 February 09 at 5:18 PM

# Berland Inc. said:

Amazon EC2, AspDotNetStoreFront and Multiple Domains

23 February 09 at 2:11 PM

# berland inc. said:

Amazon EC2, AspDotNetStoreFront and Multiple Domains

10 March 09 at 8:23 PM

# Stephan said:

What if I have multiple subdomains on different servers all running IIS 6.0.  Can I still use a wildcard SSL on all of the servers?

The subdomains match the server names under the domain.

Thanks

Stephan

18 March 09 at 3:13 PM

# Saurabh Singh said:

Stephan,

Yes you can use Wild card certificate but what is the logic behind it? Wildcard was suggested to ensure we could run multiple SSL based sites on the same server using the same cert. If you are planning to deploy different sites (although with same end-domain name) on different servers there are no restrictions which would have prompted users to go for Wildcard SSL in the first place. They are independent certs even though they are wildcard certs when deployed on different machines.

18 March 09 at 3:26 PM

# Lester said:

Would this cause any conflicts?:

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/2/SecureBindings ":443:www.test.com"

C:\Inetpub\AdminScripts>cscript.exe adsutil.vbs set /w3svc/3/SecureBindings ":443:test.com"

So far, I have an SSL certificate secured on www.test.com and my SSL certificate also secures 'test.com', as well, but I didn't do that in the securebindings yet.  Whenever I access 'test.com', I get a "Bad Request (Invalid Hostname)"

30 March 09 at 3:21 PM

# Saurabh Singh said:

Yes, I don't see it as a good option for the other site.

Wildcard should be used for multiple sites wherein they have the same end domain name (like *.test.com here) and they should have at least some different name for the prefix in the URL, like www, mail, etc.etc. In your case I don't see any prefix in the host header for the 2nd website which seems to be just test.com.

My best bet would be to have something added to the beginning of the 2nd website, like <abcd>.test.com and then add the secure binding for it like ":443:<abcd>.test.com".

30 March 09 at 3:45 PM

# Lester said:

actually, to comment on my previous post, my site identifier will be the same - since they are both the same site. Would this cause an issue?  I've already setup the secure bindings and host header for 'www.test.com' only.  So is there a way I can "add", 'test.com' to this as well or do I have to do this separately?

30 March 09 at 3:45 PM

# Saurabh Singh said:

Okay, so in that case wherein both the URLs are pointing to the same site you will get Bad Request error as expected because you have the securebindings mapped to one of these Urls. If you did not have securebindings mapped at all to any of the urls both the urls should have worked.

To add multiple securebindings entry to the same website for different urls here is the command you need to try:

Cscript adsutil.vbs set w3svc/<SiteID>/SecureBindings ":443:adv.contoso.com"

":443:sales.contoso.com"

In your case run this cmd and you should be good.

cscript adsutil.vbs set w3svc/<SiteID>/securebindings ":443:www.test.com" ":443:test.com"

30 March 09 at 4:08 PM

# Lester said:

Thanks for your reply Saurabh!  Since I've already created the secure bindings for just 'www.test.com', is there a way I can open this up and edit it and add 'test.com'?  Or do I just simply run this command and again and enter the two sites, as instructed?

30 March 09 at 4:14 PM

# Saurabh Singh said:

Np, yes you can rerun the same command with the modified parameters.

30 March 09 at 4:17 PM

# Lester said:

Thank you, Saurabh!  That worked brilliantly!

30 March 09 at 4:31 PM

# Allen said:

Hi,

 I've installed a wildcard cert for two sites (subdomains, both) and run the adsutil.vbs as described, but I get a 400 (Bad Request) error when attempting to browse to the site.

I'm using "all unassigned" IPs, is that a problem?

If any more information would help, I'd be glad to provide.  Thanks a great deal for your post, it's been quite helpful

22 April 09 at 11:40 AM

# Saurabh Singh said:

Hi Allen,

I would request you to send me the metabase.xml file from the IIS server where we are seeing the problem.

Please contact me directly at xxxxx@yyyy.com[deleted]

tnx

22 April 09 at 12:24 PM

# karen.pertierra said:

hello,

I tried you suggested commands:

cscript adsutil.vbs set w3svc/<SiteID>/securebindings ":443:www.test.com" ":443:test.com"

but all my subdomain redirects to the main website.  For example, the SSL certificate is:  *.test.com,

https://test.com works perfectly.

But https://admin.test.com redirects to https://test.com

Any workaround?

27 May 09 at 12:20 AM

# Saurabh Singh said:

Karen, the above cmd you ran is meant for URLs that are pointing to the same site. It seems in your case your URLs are pointing to different sites. In such a case you need to follow the cmd mentioned in the post and not the one you have tried.

27 May 09 at 5:17 PM

# Roneil said:

Saurabh, brillant article and comment responses.

One question I could not figure out, if each of my subdomains is assigned a different IP address instead of all assigned to default, would this make any difference, of we can still put wildcard certs up on each of these sites with a different IP address as long as the base domain is the same for all the sites.

Thanks

Roneil

28 May 09 at 10:48 PM

# Saurabh Singh said:

Roneil, thanks for the kind words :-).

Regrding your question, I haven't tested this but I feel there should not be an issue around this. Are you getting into some issues?

29 May 09 at 1:51 AM

# Darren Thompson said:

Great article.

When i look in my C:\Inetpub\AdminScripts folder, i don't see cscript.exe even though i have Win 2003.

Is this something that is supposed to be there or i need to download it?

Thanks

12 June 09 at 6:39 PM

# Saurabh Singh said:

Darren,

By default when you install IIS it gets copied to the above location. Check to ensure you don't have some other drive as the system drive.

Or else you can just copy it from any other Win2k3 server which has this file.

tnx

12 June 09 at 6:46 PM

# Darren Thompson said:

Not sure what I'm doing wrong but all I get when I type this in is an error.

What I'm typing in at the command prompt:

c:\inetpub\adminscripts>cscript.exe adsutil.vbs set /w3svc/690117/securebindings ":443:[websitename]"

Error:

'C:\inetpub\AdminScripts' is not recognized as an internal or external command, operable program or batch file.

Any thoughts?

15 June 09 at 10:45 AM

# Michele Memè said:

Great article and well set out.

Thanks

28 July 09 at 11:21 AM

# Bob Hartl said:

I understand about how to configure SSL Host Headers.  In particular I noted this suggestion:

cscript adsutil.vbs set w3svc/<SiteID>/securebindings ":443:www.test.com" ":443:test.com"

I am interested in the scenario where I have a wildcard certificate for "*.test.com".

The example above suggests that SSL Host Headers works not only for subdomains of test.com:

sub1.test.com

sub2.test.com

etc.

-- but also for the root domain "test.com" itself.  So two questions:

Q1) Do SSL Host Headers work in this way -- where if you have a wildcard cert for *.test.com, then using SSL Host Headers you can use this wildcard cert not only for sub1.test.com and sub2.test.com, but also for the root test.com?  Does this work?

Q2) Can you specify two names -- e.g. www.test.com and test.com on a single SecureBindings command (and also specify both names as regular host headers for the web site in question)?   If the web site is configured for requiring SSL, then do https requests work for either www.test.com and test.com?  Does it work without getting any "the name on the certificate doesn't match the URL" error?

Thanks!

28 July 09 at 3:09 PM

# Saurabh Singh said:

Bob, am sorry for the delayed response..i was OOF last week. Are you still looking for an answer to your last comment?

03 August 09 at 12:07 PM

# Marcus Dempsey said:

Hi, nice Blog on widecard SSL.  I have a question which I can't seem to get working correctly.

I have a number of web servers which have a number of websites, one of my sites needs to have a wildcard certificate assigned to the site, however there can be many hostnames assigned against the domain where the wildcard certificate is assigned to.

How do I bind this wildcard to any number of hostnames - i dont want to have to create hundreads of hostheaders.

example:

wildcard cert - *.domain.com

any number of possible hostnames for example:

site1.domain.com

site2.domain.com

..

..

site100.domain.com

I tried to execute cscript.exe c:\inetpub\adminscripts\adsutil.vbs set /w3svc/1159510216/SecureBindings "10.0.0.1:443:*.domain.com"

But when trying to browse to one of the valid domains I get a message saying that this site is not protected, certificate is only for *.domain.com

Can you help?

11 August 09 at 2:48 AM

# Saurabh Singh said:

Marcus, you cannot run multiple sites using the same IP and port for SSL without wildcard cert (not sure if I got it correctly). You need to run the command in the following format:

cscript.exe adsutil.vbs set /w3svc/1159510216/SecureBindings ":443:site1.domain.com" ":443:site2.domain.com" etc.

11 August 09 at 1:51 PM

# Marcus Dempsey said:

Thanks, thought as much, do you know what the limit is for adding secure bindings to hostheaders via that command?  I only ask because we may have at least a hundred or so over the coming months.

11 August 09 at 4:08 PM

# Saurabh Singh said:

AFAIK, there is no such upper limit. I would suggest to add the entries for at least 2-3 sites as per the command and browse the site and see if it works as per your expectations. If yes, then you can go ahead adding more without a limit.

11 August 09 at 4:14 PM

# cthies said:

I just used the above SecureBindings script for a primary URL and three subdomains.

www.website.com

sub1.website.com

sub2.website.com

sub3.website.com

Everything worked fine for 10 minutes then the whole site crashed.  I tried to remove the certificates and it still is down.  How is the script for the SecureBindings removed?  

Thanks for any help.

21 August 09 at 9:25 AM

# cthies said:

This is a second attempt to post this.  What is the process to REMOVE the script that changes the SecureBindings?  

21 August 09 at 11:24 AM

# Saurabh Singh said:

Cthies, am sorry for the delayed response, i was away on vacation and had no network access (Ladakh is one such place ;-)).

Regarding your questions, you can run the following command (assuming your site is running on Port 443)

>cscript.exe adsutil.vbs set /w3svc/<site identifier>/SecureBindings ":443:"

Hope this helps, do feel free to engage me if you have further questions, and am again once more sorry for the delayed response.

29 August 09 at 11:18 AM

# Theo San Juan said:

Saurabh,

I would also like to know the answer to Bob's Question about the root test.com. I am in the same situation where I have a wild card certificate.  Everything works fine with the host headers but when I add the root as a host header mydomain.com.  But when I browse to it https:\\mydomain.com I get the Mismatched Address error in IE 8. Any suggestions?

Thanks.

15 October 09 at 8:33 AM

# Saurabh Singh said:

Answer to your/Bob's questions:

Q1) Do SSL Host Headers work in this way -- where if you have a wildcard cert for *.test.com, then using SSL Host Headers you can use this wildcard cert not only for sub1.test.com and sub2.test.com, but also for the root test.com?  Does this work?

=> Yes, it works!

Q2) Can you specify two names -- e.g. www.test.com and test.com on a single SecureBindings command (and also specify both names as regular host headers for the web site in question)?   If the web site is configured for requiring SSL, then do https requests work for either www.test.com and test.com?  Does it work without getting any "the name on the certificate doesn't match the URL" error?

=> Yes,

cscript adsutil.vbs set w3svc/<SiteID>/securebindings ":443:www.test.com" ":443:test.com"

It works with both the URLs, however you will get the above Security alert when you access it with test.com. It will work smoothly with www.test.com here.

Hope that helps!

15 October 09 at 3:22 PM

# Pablo said:

I have one Host (IIS installed) , two Web Sites (www.site1.com , www.site2.com) and two different certificates (one for site1.com , one for site2.com).

Can I install both certificates and assign  one for each site?

ej: cscript.exe adsutil.vbs set /w3svc/1159510216/SecureBindings ":443:www.site1.com"

set /w3svc/1159510217/SecureBindings ":443:www.site2.com"

one of the documents I have read says: " If multiple SSL certificates are used, the server will usually encounter problems providing the correct SSL certificate when an HTTPS connection is established, causing a certificate name error when connecting. "

01 December 09 at 6:21 AM

# Saurabh Singh said:

You will have to set the websites to run on different IP addresses or ports. You cannot have both of them running on the same combination of IP address/port. I am assuming the cert is not a wildcard cert here for the web sites.

01 December 09 at 10:16 AM

Leave a Comment

Comment Policy: No HTML allowed. URIs and line breaks are converted automatically. Your e–mail address will not show up on any public page.

Name (required) 

Your URL (optional)

Comments (required) 

  

Enter Code Here: Required

Remember Me?

About Saurabh Singh