title: Multiple certificates for HTTPS on a software NLB'd IIS7 cluster
body: <p>We're currently trying to set up a HTTPS with multiple certificates. We've had some limited success but we're getting some results I can't make any sense of...</p>
  
  <p>Basically we have two servers on our NLB (10.0.51.51 and 10.0.51.52) and two IPs assigned to our NLB (10.0.51.2 and 10.0.51.4) and we have IIS listening on both of these IPs with a different wildcard certificates (To avoid giving out public IP's let's say A:443 routes to 10.0.51.2:443 and B:443 routes to 10.0.51.4:443). We also have a Cisco router using port address translation to route port 443 from two external IP's to these internal NLB IPs.</p>
  
  <p>The weird thing is, this works if we request A:443 or B:443, but if you go internally on 10.0.51.51:443, 10.0.51.52:443, 10.0.51.2:443 or 10.0.51.4:443 you ALWAYS get the same SSL cert. This cert was in the past assigned to *:443 but we've made sure there's no * bindings anymore defined in IIS.</p>
  
  <p>When i run "netsh http show sslcert" after trimming out all the irrelevant stuff I get:</p>
  
  <pre><code>IP:port                 : 0.0.0.0:443 
  Certificate Hash        : &lt;Removed: Cert 1&gt;
  
  IP:port                 : 10.0.51.2:446 
  Certificate Hash        : &lt;Removed: Cert 3 - Another site&gt;
  
  IP:port                 : 10.0.51.3:446 
  Certificate Hash        : &lt;Removed: Cert 3 - Another site&gt;
  
  IP:port                 : 10.0.51.4:443 
  Certificate Hash        : &lt;Removed: Cert 2&gt;
  </code></pre>
  
  <p>Which tells me that the * binding is still in there, which is a bit weird, but I can't see why that would prevent the other from working (Or even more more strangely why the request through the router would work).</p>
  
  <p>It's got me wondering whether it's actually treating the requests as the machine's IP rather than the NLB IP, but unfortunately our dev environment is only a single server which sorta reduces the amount of trial/error I can take to this (Since all I can test on is a live environment) without convincing management to buy more servers for the test environment - which is something I'm trying.</p>
  
  <p>Does anyone have any idea:</p>
  
  <ol>
  <li>Why there's a difference between internal and through the router?</li>
  <li>Why the internal request is getting the wrong cert?</li>
  <li>How I can remedy this so that we get the same behavior on both sides?</li>
  </ol>