IIS Server Security - HTTP and HTTPS sites on same physical server?

Author

HTTP and HTTPS sites on same physical server?

flynch@alternativenetworks.com

2006-02-17, 10:41 pm

Hi All,

Looking for advice on the advisability of putting HTTP and HTTPS sites
on same physical server where the certificate is associated. Obviously
HTTPS addresses transfer of data rather than site/server security
however it wold be great to get an authoritative view on this.

Must admit at the very least it 'feels' wrong!

Many thanks in advance
Fergus

Ratatooie

2006-02-17, 10:41 pm

I run several servers like you describe.

1 Ip address has all non secured sites on each server (up to about 100 of
them)

Then another 200 IP addresses are assigned to the server NIC with one
secured site each on it's own IP.

It works fine.

The only thing you can't do is run two secured sites on the same IP.

Remember, "encryption" for SSL ONLY INCLUDES THE DATA TRANSFER BETWEEN
SERVER MEMORY AND CLIENT (browser) MEMORY. It has NOTHING to do with the
files or file system of the server itself or the client itself.
Misunderstanding that might be where you get the "wrong" feeling about it...

<flynch@alternativenetworks.com> wrote in message
news:1140100151.464167.126490@f14g2000cwb.googlegroups.com...
> Hi All,
>
> Looking for advice on the advisability of putting HTTP and HTTPS sites
> on same physical server where the certificate is associated. Obviously
> HTTPS addresses transfer of data rather than site/server security
> however it wold be great to get an authoritative view on this.
>
> Must admit at the very least it 'feels' wrong!
>
> Many thanks in advance
> Fergus
>

flynch

2006-02-21, 7:49 am

Thanks for this....we have the setup working nicely, always helpful to
get some external opinions when dealing with security matters.

Cheers
Fergus