Write down the hostname-to-site mapping
For each hostname, list its DNS destination, IIS site, local IP and port, physical directory and expected certificate names. Behind NAT, the local binding address may differ from public DNS. Recording this distinction prevents publishing to the wrong destination.
Treat the apex name, www and application subdomains as separate entry points. Decide the DNS, HTTPS and content behavior of each. Include unexpected hostnames in the test plan so they do not accidentally display another customer’s site.
Understand certificate and site selection
SNI carries the requested server name during TLS negotiation and enables certificate selection on a shared IP and port. An IIS binding associates a site with protocol, address, port and hostname. The certificate names must match the intended connection.
Opening the IP address in a browser is not equivalent to testing the domain over HTTPS. Connect with the correct hostname and validate name, trust chain and expiry together. Bypassing a certificate warning does not complete an acceptance test.
Define expected behavior for each entry point
| Request | Expected outcome |
|---|---|
| https://example.com | Intended site with valid name and trust chain |
| https://www.example.com | Valid certificate before a controlled redirect |
| http://example.com | Redirect to the planned HTTPS address |
| Another customer domain | That customer’s site and expected certificate |
Avoid breaking neighboring sites
- Back up current bindings and certificate assignments; identify sites sharing the same endpoint.
- Verify external DNS and reachability for the new hostname and satisfy the certificate issuance method.
- Create or correct the target site’s mapping without rewriting other working bindings.
- Check the new site and an existing neighboring site externally. Confirm that redirects terminate without a loop.
Repeat connection tests after renewal
Issuing a replacement certificate does not by itself prove that the active binding now uses it. After renewal, inspect the dates and name match of the certificate returned by a real hostname connection.
The certificate used by SMTP or IMAP can be configured independently from IIS. A successful web TLS test does not establish that mail TLS is correct. Inventory and verify each service separately.
Record the public certificate fingerprint to distinguish the certificate presented before and after renewal. Never include the private key in that record.
Frequently asked questions
Does each HTTPS site need its own IP?
SNI-capable IIS and clients can serve multiple HTTPS sites on one IP. Hostname bindings and certificate assignments must be correct.
Does an HTTPS www redirect need a certificate?
Yes. TLS is established before the client receives the HTTP redirect, so the www connection must present an appropriate certificate too.
Can I test only by IP address?
No. Use the expected hostname to exercise certificate name and SNI behavior. An IP request may select another site or certificate.
Does fixing IIS SSL also fix SMTP TLS?
Do not assume that. Verify the mail service’s certificate selection and reload behavior separately.