Removing sites from IIS wildcard certificate error

Question

When trying to remove a site from IIS this message comes up. “The certificate associated with the HTTPS binding of this site is also assigned to another site’s binding. Deleting this site will cause the HTTPS binding of the other site to be unusable. Do you still want to continue:” I tried to edit the binding to remove it that way and same results. We use wild card binding for our sites. Any suggestions on how to remove this?

The server is running Windows Server 2008 R2 Standard, IIS 7.5.7600.

Solution 1

If you are using a wildcard certificate with multiple sites/bindings you would have had to edit the configuration file or used the command line tool to do so. Simply re-use either of those methods to remove the binding. Wildcard Certs and bindings don't play nicely together, especially on the same IP.

You should be able to remove the binding using the command line tool without running into too much of a problem. Worst case you use the UI to remove it and have to re-add the bindings to the other sites again.

Hopefully I understood your setup correctly.

Solution 2

If your server has many sites using the same wildcard certificate on a single IP address, you then can ignore the messages when updating a website conf.

When deleting https bindings from any website, the wildcard certificate association will be removed from all the other sites. Even though, by fixing just one of them the others will be fixed as well.

Solution 3

Running the following before deleting your site will solve the problem. There is not any GUI handling for multiple SSL sites on the same IP in IIS 7.5.

appcmd set site <your site name in IIS> /-bindings.[protocol='https',bindingInformation='<your bound ip>:443:<your host name>']

appcmd is located in C:\Windows\System32\Inetsrv

It's the same command that you likely used to add the SSL binding in the first place with a "-" in place of a "+". For information about adding multiple SSL bindings to the same IP, see this post

Comments

[Phil Hannent]

Whilst this is crazy and must be a flaw in the IIS interface. I just tried it out and can vouch for this answer.