Configuring a subdomain to use HTTPS

Question

I have a domain that we will call www.mydomain.com for reference. I have a subdomain on m.mydomain.com for people who want to view the website through their mobile devices. My users are registered on this site, so I would like to protect their credentials, if possible. Because of this, I have acquired an SSL certificate.

I am not a guru of SSL certificates, so I can misunderstand something. I thought that I could have one SSL certificate for my domain. However, when I try to access https://m.mydomain.com , I redirect to https://www.mydomain.com instead of viewing the contents of http://m.mydomain.com . In other words, here is a list of my configurations and results from IIS 7:

Site Name Binding Type Host Name Port IP Address Result via Browser --------- ------------ --------- ---- ---------- ----------------------------------- MySite http 80 ww.xx.yyy.zz http://www.mydomain.com works fine MySite https 443 ww.xx.yyy.zz https://www.mydomain.com works fine MyMobileSite http m.mydomain.com 80 ww.xx.yyy.zz http://m.mydomain.com works 

My first guess was to add a new https binding to MyMobileSite on port 443. However, in this process, I noticed that I was asked to choose an SSL certificate. I am worried that if I select the SSL certificate associated with MySite, it will break this binding. Once again, I do not fully understand SSL certificates. Can I use the same SSL certificate on multiple IIS sites and multiple binding if they use the same domain? Can I continue and create the binding as I thought? My main concern is that I’m breaking something and I can’t cancel it.

Thanks!

Answer 1

No, the fact is that certificates are used to verify that you are not using someone else's ip (spoofing), I suggest using linux and self-signed ssl certificates, but if your windows using windows also just use ssl for everyone your domains, while there is an (external) IP,

hope this helps.

PS SSL is just a way to secure encrypted protocols between a server and a client.

I always recommend having: 443 and: 80 for everyone to choose how they connect, unless you are running confidential data streams for money transfers, etc., then defiantly make sure it uses secure (443 port ) and never port 80 (unsecured connection).

Answer 2

It all depends on the type of certificate you purchased. Usually your lowest binding costs are tied directly to a single domain name / subdomain. However, there are certificates that you can buy, for example, http://www.verisign.com/ssl/buy-ssl-certificates/subject-alternative-name-certificates/index.html Depending on the policy of your organization for the purchase, I I would almost simply offer to buy a separate one for a mobile site.