Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

SSL showing against wrong domain on shared server

Posted on 2008-10-13
3
Medium Priority
?
231 Views
Last Modified: 2008-10-22
I have a webserver which contains numerous domains.  One of these domains has an SSL applied to it, running on port 443 as normal.

However, because all of the domains share the same IP address, you can simply type any of the domains behind a https:// and it'll pass them to the one with the SSL!

So, if I have the following domain which has the SSL applied to it:

https://www.firstdomain.com/cart.asp

I can easily use:

https://www.anyotherdomainonthisserver.com/cart.asp 

to get to the same place!  This has the effect of showing scripts under a domain that they aren't actually under.

Does anyone know how I can isolate this such that any https call to domains OTHER than the one on which the SSL exists cause a failure or redirect?

Thanks,

Tony
0
Comment
Question by:xxiantweb
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 4

Expert Comment

by:palner
ID: 22705395
SSL has the problem of using only 1 IP address. Microsoft does allow using multiple SSL with 1 IP address and a wildcard SSL, however *.singledomain.com generally isn't wanted when hosting multiple domain names.

One way to hide the ssl is if all pages were using .asp or .net. You can then check the domain (from the server variable) and if it doesnot match, redirect to the non-ssl site.

There are many approaches, this one worked best for us... we used this method and a 403 error that was also an asp with a simple redirect.
0
 
LVL 10

Assisted Solution

by:RubalJ
RubalJ earned 600 total points
ID: 22705870
SSL Domain should be on a dedicated IP. If you setup dedicated IP for site and point WWW A record on that dedicated IP and change the HTTPS IP to that dedicated one with port 443 then it'll resolve your issue.

0
 
LVL 4

Accepted Solution

by:
palner earned 900 total points
ID: 22706000
Since all domains are using that IP, he'll still need a way of stopping the other domains from hitting the ssl and questioning the non-matching domain name.
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

First of all, clustering IIS is something you should rarely consider doing. In almost all cases, Microsoft Network Load Balancing (NLB) (http://technet.microsoft.com/en-us/library/cc758834(WS.10).aspx) is a much better solution when you need to p…
Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question