1

I recently installed certs for the three sites on IIS for my Farm that needed them - Central Admin, the main web app, and the MySite site.

When I installed the certs the bindings were for port 443 and if I changed one cert, all other certs would change since they were all on 443.

I figured I needed to put IP address in bindings. We created three DNS entries and changed the bindings so each app pool could have its cert installed on its app.

Figured I was good to go and it seemed like I was. I stopped getting the cert error message and the site loaded up and all was fine.

Except today. I logged on midday and got 'Access Denied'. When I removed the IP addresses in the bindings, I was able to log on. This happened again with central admin.

What am I missing?

Do I have to retract the host headers before changing the bindings?

Improve this question

1 Answer 1

Reset to default
1

I'm not sure what Server type you are trying this on. For Windows Server 2012 R2, or Server 2008, you should not need to enter IP addresses for the bindings UNLESS you have multiple IP addresses for the actual server. The host header and port number are enough to sort the traffic.

It almost sounds like you initially added the IP addresses and appeared okay, until an IIS RESET or server restart actually applied the values.

What will happen is this. If you set the IP address specific to a binding, traffic stops at the first site it sees. e.g.

  • 123.123.123.123 blahblah.com 443

  • 123.123.123.123 notnowmom.com 443

All traffic will stop at blahblah.com and confuse you with 'Access Denied' messages (because your permissions aren't the same on the site you actually got dumped at), or worse, just show you the wrong web page and confuse you.

All you should need is

  • All Unassigned blahblah.com 443
  • All Unassigned notnowmom.com 443

Edit: Server 2008 R2 (IIS 7.0) will only accept one certificate per IP address. So use alternative names on your domain certificate to neatly sidestep this. Or have an IP address assigned to your server per certificate.

Server 2012 R2 (IIS 8.0+) will accept more than one certificate. If you have an individual certificate per host name, start with the first site, 'Edit Bindings' assign the certificate. For the second site and thereafter, check the 'Require Server Name Indication' box, then assign your second certificate, and so forth. Again, using a domain certificate with Subject Alternative Names will allow you to use the same certificate for all the sites. There may be good reasons to NOT do that though, so 'Server Name Indication' is your friend. (Threat Management Gateway 2010 does NOT support Server Name Indication)

Improve this answer
2
  • This Server2012 R2. When I added the bindings and the host header, it all goes crazy. When I take them away, it works fine except it still has the cert error. I've tried just the IP and no host header, but it only seems to work with host header and no IP (again, except that it still throws the cert error). Why won't it take the cert?
    – Ellen
    Feb 23, 2017 at 20:14
  • Server 2012 R2 + IIS 8 will accept multiple certificates, but only if you check the 'USE SNI' button. (Note, TMG (Threat management gateway) doesn't like that). Go to Bindings, Edit, then 'Type = https. IP address, all unassigned, Port 443, Host Name = "YourSiteRocks.Com" then check the box that says 'Require Server Name Indication' I'll edit my response to include this info.
    – Jack
    Feb 23, 2017 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.