Multiple SSL hosting -- iis security

Joe
10/6/2004 2:42:56 AM

Thank you Bernard,
I haven't talked to you in a long while . Nice to hear
from you.

So what does this mean>>> afaik?

So your saying each SSL site has to have an IP included
in the hosting package?

Thank you
Joe
[quoted text, click to view]

Alun Jones [MSFT]
10/6/2004 11:17:18 AM

[quoted text, click to view]

Here's a quick description, to demonstrate why:

1. The client takes the URL and resolves the name into an IP address, and a
port (usually a default port).
2. The client connects to that IP address, on the requested port
3. The server running at that IP address and port answers.
4. The client sends a "hello" message, asking the server to send its
certificate.
5. The server sends the certificate to the client.
6. The client checks the name in the certificate against the name it had in
step 1.
7.1. If the certificate matches, the client and server start encrypted
exchanges.
7.2. If the certificate doesn't match, the client displays an error to the
user and stops.
8. The client sends HTTP request headers, encrypted, to the server.
9. The server sends back HTTP responses, encrypted, containing content
requested.

Note that host headers are sent in step 8, but the server has to pick a
certificate to send in step 5, and that certificate must have the server
name that the user asked for. The server has no clue as to which
certificate it must pick, so it must have a single certificate to send back
on that IP address and port.

There is work under way to produce a "next version" of TLS, that will allow
a client to send the host name it wants in step 4, so that the server can
choose among several certificates, but it is not clear exactly when (if
ever) this will be implemented in browsers or web servers - and it has to be
implemented, and enabled, in both if it is to work.

Alun.
~~~~

Bernard
10/6/2004 11:51:41 AM

Yes, afaik those hosters allocate one IP for each SSL site.

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/

[quoted text, click to view]

Joe
10/6/2004 2:01:22 PM

This is fantastic information thank you Alun,

So I would need to provide either a server for each SSL
site or an aditional IP correct?

For example
12.164.55.148 can have SSL only one on port 80
and If I need another I would set it like this:
12.164.55.149 SSL on port 80

and so on...

Thanks
Joe

[quoted text, click to view]

Bernard
10/6/2004 6:10:48 PM

afaik - as far as i know :)

yes, your understanding is correct.

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/

[quoted text, click to view]

Bernard
10/7/2004 12:30:20 PM

Yes. or you can bind to same IP different port
say 443, 4433, 44433 and etc
but this is inconvenience, as the port need to be specify along with the
url. e.g. https:/abc.com:4433/

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/

[quoted text, click to view]

Joe
10/7/2004 5:33:49 PM

Thanks Bernard,

Yes I am aware of the port in the URL. But yes, it is a
very big inconvenience. No one wants to tyoe that.

Thank you
Joe
[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

iis security : Multiple SSL hosting