Search code examples
ssliisssl-certificateiis-7.5wildcard-subdomain

IIS 7.5 Multiple subdomains same wildcard certificate


This is an odd problem as all I'm trying to do is extend a configuration that is already happily functioning as described by adding a new web site, which is just a copy of an existing web application.

So what we have is a wildcard certificate *.business.com

We already have 8 other sites bound to the same SSL certificate each with their own host names.

  • a.business.com
  • b.business.com
  • ..
  • h.business.com

All the existing sites are quite different in their role/application/structure so in that sense there aren't any duplicate files or applications.

I'm trying to add x.business.com and for some reason IIS does not want to know about it. I'll explain what I've done and hopefully someone will see the erro of my ways.

My first step was to set an A record in the DNS for the domain.

So all the other URLs listed above all point to the same public IP address.

Lets call it 100.10.10.100

I then created a simple website in IIS with a simple default.htm for testing.

After setting the host name to x.business.com and binding the SSL certificate (using appcmd) I tested the site address. Nothing. By that I mean a generic error saying the site is unreachable. At this point there is no log as the site hasn't served anything.

A ping of the URL returns the IP address set in the DNS but no response.

To try and simplify I added another simple site called TestSite. I made an entry in the hosts file 127.0.0.1 TestSite. Tried the IIS server browser and this also didn't work.

However when I changed the TestSite to use port 81 and then tested http://testsite:81 I got a positive response.

I then tried to extend this test and made another A record testsite.business.com. Added the host name to the existing testsite and then tried http://testsite.business.com:81 it failed.

Rolling everything back and it worked again.

For the life of me I can't see what I need to do to get this working. It seems like a DNS issue but the other 8 sites are all working fine with the same IP address:port (eg 100.10.10.100:80), multiple sites bound to the same SSL certificate without issue and have been working from nearly two years.

I'd like to add I didn't set this up hence the groping around in the dark, but I'm sure I've done something similar in the past without issue.

I've searched for hours and have not found anything glaringly obvious that I've missed. it also worries me when I see few posts with similar issues it makes me think I'm missing something truly basic.

Your thoughts on diagnosing this issue are appreciated.


Solution

  • OK folks you can all relax.

    Two issues a typo in the DNS A record. Yep that's on me.

    However I also found an interesting piece of code in the default web site.

    Default.asp has the following code. It appears this is doing a bit of translation of incoming web requests and redirection.

    	// Redirect appropriately
    	response.buffer = True
    	response.clear
    	response.status = "301 Moved"
    	If InStr(sServerName,"a") > 0 Then
    		response.addHeader "Location", "https://a.business.com/" & Request.QueryString
    	Elseif InStr(sServerName,"b") > 0 Then
    		response.addHeader "Location", "https://b.business.com/" & Request.QueryString
    	End If

    So I added

    	// Redirect appropriately
    	response.buffer = True
    	response.clear
    	response.status = "301 Moved"
    	If InStr(sServerName,"a") > 0 Then
    		response.addHeader "Location", "https://a.business.com/" & Request.QueryString
    	Elseif InStr(sServerName,"b") > 0 Then
    		response.addHeader "Location", "https://b.business.com/" & Request.QueryString
    	Elseif InStr(sServerName,"x") > 0 Then
    		response.addHeader "Location", "https://x.business.com/" & Request.QueryString
    	End If