CODEWITHSUNDEEP
sslhttpscertificateiis-7.5url-rewrite-module
Stefan Thüring
Stefan Thüring

Reputation: 3

IIS 7.5 SSL https - wrong site appears when calling other site

IIS 7.5

non-ssl-test.com is port 80 only, secure-site.com is port 443 only

Both work if called correctly: http://non-ssl-test.com & https://secure-site.com

But if I call https://non-ssl-test.com and accept the certificate warning the content of secure-site.com appears.

WTF, I want https://non-ssl-test.com to fail !

Upvotes: 0

Views: 398

Answers (2)

Lex Li
Lex Li

Reputation: 63295

That's exactly how IP mapping works when SSL/TLS handshakes happen.

https://www.jexusmanager.com/en/latest/tutorials/https-binding.html#ip-based-bindings

As IIS 7.x does not have SNI, all HTTPS requests go to the IP based mapping. Web browsers see the certificate you bind there, and display whatever warnings/errors they would like to. TLS handshake happens so early and the browsers prompt immediately, so you have no way on IIS to avoid the prompt.

If you want https://non-ssl-test.com to fail completely, you have to modify the site bindings to have no IP based SSL binding at all. Like the other answer indicate, that usually means another IP address is needed,

  • bind the two sites to different IP addresses.
  • bind the certificate to the IP address you like, but not the other.

Then HTTPS requests to the second IP without any certificate, would fail as you wished.

Upvotes: 0

vcsjones
vcsjones

Reputation: 141703

IIS did not gain support for SNI until IIS 8.0. Without SNI, IIS doesn't understand how to handle two different hosts on the same IP address.

You can either use a newer version of Windows and IIS, or use two separate IP addresses for your sites.

Upvotes: 1

Related Questions