# IIS bindings, host headers and SNI: host many sites on one IP

> Understand IP:port:host-header bindings, add multiple HTTP/HTTPS sites, use SNI correctly, and diagnose duplicate-binding and certificate-name failures.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29
- Test machine: IIS Manager UI reference: VM 361 Windows 11 26H2; Lab site :8080 binding; Server 2025 cmdlets E1

Lab site bindings on VM 361: http, port 8080, IP `*`, no host header. This is the simple lab case; host headers/SNI come next. Windows 11 UI reference; Server 2025 steps E1.

## The short answer

An IIS binding is:

```text
protocol  IP:port:host-header
http      *:80:lab.internal
https     *:443:lab.internal   + SNI + certificate
```

- **IP** can be `*` (all), a specific address, or a wildcard.
- **Port** distinguishes endpoints, not sites.
- **Host header** lets many HTTP sites share `*:80`.
- **SNI** does the same for HTTPS certificates; without SNI, one IP:port gets one certificate.

Use one site per hostname, not one site per folder. Use applications for paths under a hostname.

## HTTP: host headers

```powershell
Import-Module WebAdministration
New-WebBinding -Name 'Lab' -Protocol http -Port 8081 -HostHeader 'lab.local'
Get-WebBinding -Name 'Lab'
```

Test from the server with a Host header:

```powershell
curl.exe -H "Host: lab.local" http://127.0.0.1:8081/
```

`curl http://127.0.0.1:8081/` without the header may hit a different site or return the default site. That is why “it works on localhost but not on the domain” is often a host-header problem.

## HTTPS: SNI

Without SNI, IIS binds a certificate to an IP:port. With SNI, the client sends the hostname during the TLS handshake and IIS selects the certificate.

```powershell
New-WebBinding -Name 'Lab' -Protocol https -Port 443 -HostHeader 'lab.example' -SslFlags 1
```

`SslFlags 1` means SNI enabled. Then bind the certificate (hash from `Get-ChildItem Cert:\LocalMachine\My`):

```powershell
netsh http add sslcert hostnameport=lab.example:443 `
  certhash=<thumbprint> appid={4dc3e181-e14b-4a21-b022-59fc669b0914} `
  certstorename=MY
```

Use a **hostname:port** in `netsh` for SNI. The `appid` is an arbitrary GUID IIS uses to identify the binding; keep it consistent per site.

Verify:

```powershell
netsh http show sslcert hostnameport=lab.example:443
curl.exe --resolve lab.example:443:127.0.0.1 https://lab.example/ -k
```

`--resolve` makes the test hit the local IIS even if public DNS points elsewhere. `-k` accepts the lab certificate; never use it as a production habit.

## Bindings are matched, not guessed

For HTTP, IIS matches protocol/port/IP and then the Host header. If no host header matches, it can fall back to a site bound without a host header (often Default Web Site).

For HTTPS with SNI, the hostname drives certificate selection. A mismatch produces:

- certificate name warning (client sees the wrong name);
- 404 from the wrong site;
- handshake failure if no SNI binding matches.

## Common failures

| Symptom | Likely cause |
|---|---|
| 400 Bad Request | Duplicate/invalid binding; host header malformed |
| 404 on the domain, 200 on localhost | Request hits Default Web Site |
| Certificate name mismatch | Certificate SAN does not include the hostname |
| “Cannot create a file when that file already exists” | Duplicate binding on the same IP:port:host |
| HTTPS works on one site only | No SNI / one certificate per IP:port |
| Works internally, fails externally | DNS/firewall/NAT, not IIS |

> **Caution: Do not use different ports as a routing strategy**
>
> `site-a:8080` and `site-b:8081` are separate endpoints, not virtual hosting. If users should reach both by name on 443, use host headers + SNI.

## Checklist

1. One site per hostname; one app pool per isolation boundary.
2. HTTP and HTTPS bindings use the same hostname.
3. Certificate SAN covers every name on that binding.
4. Default Web Site is stopped or intentionally bound.
5. Test with Host header/`--resolve`, not only `localhost`.
6. Document every IP:port:host and certificate thumbprint.

## Lab boundary

The screenshot is Windows 11 26H2, HTTP only, port 8080. HTTPS/SNI and Server 2025 role behavior are E1 until a Server 2025 VM and certificate lab are available.

## Sources

- [Microsoft Learn — IIS site bindings](https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/site/bindings/)
- [Microsoft Learn — IIS 8 SNI](https://learn.microsoft.com/en-us/iis/get-started/whats-new-in-iis-8/iis-80-server-name-indication-sni-ssl-scalability)
- [Microsoft Learn — New-WebBinding](https://learn.microsoft.com/en-us/powershell/module/webadministration/new-webbinding)

---

Source: https://windows.homes/en/server/web/iis-bindings/