Re: Mutliple sites needing to communicate over SSL on one IIS server

From: Kristofer Gafvert (kgafvert_at_NEWSilopia.com)
Date: 01/12/05 

Date: Wed, 12 Jan 2005 08:01:13 -0800

Hello,

As Tom says, it is not a limitation of IIS. The request (including the
host header) is encrypted, so it is impossible for IIS (or any other
webserver) to find out what the host header is.

You might also want to see:

"HTTP 1.1 Host Headers Are Not Supported When You Use SSL"
http://support.microsoft.com/?id=187504 

-- 
Regards,
Kristofer Gafvert
New Article:
www.gafvert.info/ClientToServer.htm
www.ilopia.com
Jay Hulslander wrote:
> Thanks, that would be my problem.  Is there a reason IIS does not support
> host header differentiation with SSL (443)  port requests, much like 
they do
> with port 80?
>
> "Tom Kaminski [MVP]" <tomk (A@T) mvps (D.O.T) org> wrote in message
> news:e9PPXTL%23EHA.1296@TK2MSFTNGP10.phx.gbl...
> > "Jay Hulslander" <jdh34@cornell.edu.REMOVETHIS> wrote in message
> > news:cs3ci5$rm5$1@news01.cit.cornell.edu...
> > > Hello, I need help setting up IIS to manage two sites that need to
> > > comunicate over SSL.  Here is an example:
> > > https://www.apps.com
> > > https://www.resources.com
> > >
> > > Certain pages on the apps site references images, for example, that 
are
> > > hosted on the resources site.
> > >
> > > I have the two sites set up.  I have the two sites set up with the
> proper
> > > host header information.
> > > When I go to an SSL secured page on the apps site, it works fine.  No
> > > certificate errors.  When I got to an SSL secured page on the apps 
site
> > that
> > > reference a secured image on the resouces site, I get a security 
alert
> > > stating the following.  "The name on the security certificate is 
invalid
> > or
> > > does not match the name of the site."  I checked the certificates
> > installed
> > > to each site, and appear to be correct.  My best guess is that when 
an
> SSL
> > > request comes for the resources site, IIS is returnin the certificate
> from
> > > the apps site.  I tried setting up a non standard SSL port on the
> > resources
> > > site, it made no difference.
> > >
> > > How can I properly setup this situation?
> >
> > SSL requires that each web site have its own IP address.  You cannot 
use
> > Host Headers alone to distinguish the sites.
> >
> >

Relevant Pages

  • Re: SSL broken after Windows 2003 upgrade
    ... The svchost.exe you reference is "IIS". ... routes them to the appropriate w3wp.exe based on configuration from WAS ... WFetch can make both a normal SSL request as well as a Client-Certificate ...
    (microsoft.public.inetserver.iis)
  • Re: IIS 6.0 - no host header value - Are host header requests proc
    ... The packets may not be malformed - it may be that the end client is using a DNS server that is incorrectly configured. ... In the case that a request comes in with a host header that matches none of the websites on your machine, then IIS will look for a site that is listening with no host header value *and* specifically bound to the IP address that the request came in on. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Problem processing SSL certificate response.
    ... "Download SSL Diagnostics 1.1 from Microsoft.com and use it to diagnose ... Note that I am able to work around this by requesting/processing a request ... transfering the generated PFX into the certificate store on the IIS machine. ...
    (microsoft.public.inetserver.iis.security)
  • host header names as security devices
    ... I am curious if the use of a host header name ... In the event of an HTTP request sent to the IP address (rather than to the ... hostname) of an IIS server running a web site configured with an IIS host ... match a configured host header name and there was no default site to return. ...
    (Focus-Microsoft)
  • Re: Penetration test and request Host header
    ... an information disclosure vulnerability that your penetration testers are probably going to "ding" you on. ... revolves around an intentionally incorrect Host header in a request to ... Note the Host header that contains a domain that is not ... The response from IIS looks like ...
    (microsoft.public.inetserver.iis.security)
Loading