Title: Creating IIS Site in powershell without SNI
Tags: powershell;iis;sni
Question: I am trying to create one IIS site in powershell .I want the site to be created without SNI.
I am using iis 10, ( Windows 2016 server ).
I am able to create site with SNI using sslflags=1. But When I try to create without sni, I am running into issues.
Below is my snippet
$SecurePassword = ConvertTo-SecureString "Somepassword" -AsPlainText -Force;
Import-PfxCertificate -FilePath 'C:\certs\nt111trnch01.pfx' -CertStoreLocation Cert:\LocalMachine\My -Password $SecurePassword;
Import-PfxCertificate -FilePath 'C:\certs\nt111trnch02.pfx' -CertStoreLocation Cert:\LocalMachine\My -Password $SecurePassword;
Import-PfxCertificate -FilePath 'C:\certs\nt111trnch03.pfx' -CertStoreLocation Cert:\LocalMachine\My -Password $SecurePassword;
Import-Module "WebAdministration";
New-Item IIS:\Sites\myProj -bindings @{protocol='https';bindingInformation='*:8080:nt111trnch01.sit.abcit';SslFlags=1} -PhysicalPath C:\site;
New-WebBinding -Name "myProj" -Protocol https -HostHeader nt111trnch02.sit.abcit -Port 8080 -SslFlags 1; \
New-WebBinding -Name "myProj" -Protocol https -HostHeader nt111trnch03.sit.abcit -Port 8080 -SslFlags 1; \
New-Item -Path "IIS:\SslBindings\*!8080!nt111trnch01.sit.abcit" -Thumbprint 145300EC69B3448EE15A54DBCD54647AF8294611 -SslFlags 1;
New-Item -Path "IIS:\SslBindings\*!8080!nt111trnch02.sit.abcit" -Thumbprint 86C1CD3660F9810DB30CB2E312E197C898I26253 -SslFlags 1;
New-Item -Path "IIS:\SslBindings\*!8080!nt111trnch03.sit.abcit" -Thumbprint 0C7888C0615615997DB6F9DA9E9A03E4671E3BAD -SslFlags 1;
New-Item C:\site\myProj -type directory
Note: I am able to create site with single certificate and without SNI. But binding multiple certificates causing the issues.
Thanks in advance
Update 1
I changed all SslFlags vlaue to 0.
Now I am getting this error.
New-Item : Cannot create a file when that file already exists
At line:12 char:2
+     New-Item -Path "IIS:\SslBindings\*!8080!nt111trnch02.sit.abci...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [New-Item], Win32Exception
+ FullyQualifiedErrorId : System.ComponentModel.Win32Exception,Microsoft.PowerShell.Commands.NewItemCommand
WARNING: Binding host name 'nt111trnch03.sit.abcit' is not equals to certificate subject name 'CN=nt111trnch03.sit.swcsit, OU=IT Services, O=Mycity
Company, L=Mycity, S=State, C=Country'. Client may not be able to connect to the site using HTTPS protocol.
New-Item : Cannot create a file when that file already exists
At line:13 char:2
+     New-Item -Path "IIS:\SslBindings\*!8080!nt111trnch03.sit.abci ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [New-Item], Win32Exception
+ FullyQualifiedErrorId : System.ComponentModel.Win32Exception,Microsoft.PowerShell.Commands.NewItemCommand
I went and checked IIS UI.
I can see three bindings, but all 3 bindings are using first certificate only. I think this is because of the errors above.
Comment: You appear to be trying to bind 3 SSL certificates to 3 sites, on the same IP and port. This is not a thing you can do with SSL - the server doesn't know which site the browser wants until *after* it's used a cert to to negotiate the connection. SNI was invented to solve this and allow multiple certs so the server knows which to use. You need different IPs, or different ports, or SNI, to do this.

Comment: It's an SSL technology limit, not an IIS specific problem. I don't know Netscaler, but Citrix documentation looks like [it's supported SNI for SSL offloading since version 9](https://support.citrix.com/article/CTX125798) so maybe you could answer the SSL connections on the NetScaler? Individual public IPs for each site is the normal way to handle this, but if you have no more IPs and cannot get any from your ISP, then you can't do that. Another option might be to run them all with one wildcard certificate `*.sit.abcit`, that again is more expensive. Or upgrade NetScaler to firmware 11.1 maybe.

Comment: @TessellatingHeckler I agree there was dearth of information on the initial post,and I kept updating as I was trying new scenarios. And I thought you are trolling.Thanks for the info. Apparently our Netscaler is not compatible with SNI. So if SNI is enabled our site wont work.  We have a site which will be running on 3 servers, and hence 3 certificates. I am using the above snippet in the post and executing on all 3 servers.  I am just new to IIS an maybe I am wrong in the approach

Comment: Thanks. Our team confirmed they have a Netscaler 11 and we need Netscaler 11.1 to have SNI.

Here is the accepted answer: I am able to find a solution for this.
I did IP bindng to get it working. Not sure whether it is the correct way.
I bind IP of server B to server B certificate, ip of Server C to server C certificate and all ip(*) to server A certificate.
Not sure whether this is correct or should I bind IP to their respective certificate. But this is working . Verified that Netscaler is able to do SSL handshake on all 3 servers
New-Item IIS:\Sites\myproj-bindings @{protocol='https';bindingInformation='*:8080:nt111trnch01.abcit.sit';SslFlags=0} -PhysicalPath C:\site;
New-WebBinding -Name "myproj" -Protocol https -HostHeader nt111trnch02.abcit.sit-IP 151.154.11.224 -Port 8080 -SslFlags 0;
New-WebBinding -Name "myproj" -Protocol https -HostHeader nt111trnch03.abcit.sit-IP 151.154.11.224 -Port 8080 -SslFlags 0;
New-Item -Path "IIS:\SslBindings\*!8080!nt111trnch01.abcit.sit" -Thumbprint 145300EC69B3448EE15A54DBCD54647AF8294611 -SslFlags 0;
New-Item -Path "IIS:\SslBindings\151.154.11.224!8080!nt111trnch02.abcit.sit" -Thumbprint 86C1CD3660F9810DB30CB2E312E197C898I26253 -SslFlags 0;
New-Item -Path "IIS:\SslBindings\151.154.11.224!8080!nt111trnch03.abcit.sit" -Thumbprint 0C7888C0615615997DB6F9DA9E9A03E4671E3BAD -SslFlags 0;
Please let me know if this is not the correct way.
Thanks.


{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 4, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2018:00:02/23/18', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<powershell><iis><sni>', 'Title': 'Creating IIS Site in powershell without SNI', 'ViewCount': 450, 'id': 48940192, 'user_AboutMe': '', 'user_AccountId': 2795072.0, 'user_DisplayName': 'VVP', 'user_Reputation': 666.0, 'user_Views': 296.0, 'user_id': 2404441.0}}