5

On Windows Server 2008 R2, the "Host name" box for editing the https binding is disabled. I'm unable to enable it so that I can enter the hostname for which to bind.

The certificate "issued to" field is in *.example.com format.

enter image description here

How does one enable the Host name box for editing?

EDIT: The proposed duplicate does not answer my ACTUAL question, which is "why is this box grayed out and not enabled?" Additionally, that question is dated, and does not consider an approach used here: https://blogs.msdn.microsoft.com/varunm/2013/06/18/bind-multiple-sites-on-same-ip-address-and-port-in-ssl/

Robert Kerr
  • 291
  • 1
  • 6
  • 16
  • 2
    Possible duplicate of [Setup IIS 7.5 with multiple website bindings and SSL?](http://serverfault.com/questions/284699/setup-iis-7-5-with-multiple-website-bindings-and-ssl) – Massimo Aug 01 '16 at 11:26
  • You can't: SSL doesn't work that way (unless you use SNI, which is not supported on WS2008R2). – Massimo Aug 01 '16 at 11:29
  • You sure? I"ve been trying to follow https://blogs.msdn.microsoft.com/varunm/2013/06/18/bind-multiple-sites-on-same-ip-address-and-port-in-ssl/ – Robert Kerr Aug 01 '16 at 11:40
  • 1
    Is the certificate you are using a wildcard cert? In that case the `Host name` field should be editable, if you are using a SAN certificate you have to use the command line to set the host name, the GUI is not smart enough. The article you are referring to explains all this. – Peter Hahndorf Aug 01 '16 at 12:33
  • @PeterHahndorf you are correct, and yes it is a wildcard certificate. The actual problem has turned out to be the "Friendly name" of the wildcard certificate must start with *, and asterisk. When that change was made in Certificate manager (via MMC plugins), the host name box became enabled. Note in my screenshot, the friendly name began with "Star". If you would create an answer that reflects that, I will accept it as the answer. – Robert Kerr Aug 01 '16 at 12:51

1 Answers1

8

The issue here is the way IIS identifies a wildcard certificate. It doesn't look in the Issued to field but in the Friendly name field of the certificate. That field has to start with the * wildcard character.

You can change the friendly name without any consequences, start mmc.exe as an elevated administrator and add the Snap-in for Certificates - Computer Account - Local Computer

Find the certificate in the Personal - Certificates folder, open the properties dialog and change the Friendly name to begin with a *.

You may have to restart IIS Manager to see the new name. The Host name field should now be editable.

Peter Hahndorf
  • 14,058
  • 3
  • 41
  • 58
  • As of IIS 7.5 (aka MS Server 2008 R2), it seems there could be only one certificate across all the web sites and (HTTPS) bindings. So if you have multiple websites/bindings (ie multiple domain names), you need one certificate with multiple DNS names (alternative DNS names). This is possible to have it from Let's Encrypt for free, for example by https://github.com/PKISharp/win-acme as "SAN certificate for all bindings of multiple IIS sites". Don'n forget to change friendly name as suggested above if you would like to edit bindings by GUI then. – Milan Kerslager Jun 24 '18 at 15:39