1

I want to show a specific page for unbound HTTPS URLs. I have set up a basic website with an empty HTTPS binding, and this seems to work ok.

Am I right in thinking it is acting as a 'catch-all' for any HTTPS URLs that aren't already bound to other sites? Is there a chance it may 'catch' valid URLs that are in a binding?

In what order does IIS match a URL against bindings?

userSteve
  • 1,573
  • 4
  • 23
  • 33
  • https://www.jexusmanager.com/en/latest/tutorials/binding-diagnostics.html Binding Diagnostics reports how site bindings can be interpreted, which might help you understand the scenarios. – Lex Li Apr 16 '18 at 20:52

1 Answers1

2

Yes you are correct, an empty host name for an https binding catches all requests not already handled by other sites on the server. The IP addresses still play a role as well, if you have multiple ones.

IIS matches more specific bindings first, so one with no host name will be very low in the order.

Any requests to that site will most likely result in a certificate error and the requested host name and the name in the certificate for the site will most likely be different.

I am running catch-all sites on my IIS servers for over ten years and never seen and problems with it.

DonnellyOverflow
  • 103
  • 2
Peter Hahndorf
  • 14,058
  • 3
  • 41
  • 58