title: IIS 8.5, Central Certificate Store, Wildcard SSL and website with no host name
body: <p>I'm having a problem using the IIS8 Central Certificate Store with a wildcard certificate. I have a web server farm that is configured to use CCS. I have a wild card certificate "*.delaneywilson.com". I created a pfx file for the wildcard cert, named it "_.delaneywilson.com" (as instructed by <a href="https://docs.microsoft.com/en-us/iis/get-started/whats-new-in-iis-8/iis-80-centralized-ssl-certificate-support-ssl-scalability-and-manageability" rel="nofollow noreferrer">Microsoft</a> and other articles on the web) and then dropped it into my shared SSL directory. The certificate shows up in IIS without an issues. </p>
  
  <p>I created bindings for www.delaneywilson.com and delaneywilson.com, both using port 443, set to "All Unassigned", "Require Server Name Identification" and "Use Centralized Certificate Store". The binding with the www works fine, but the binding without the host name does not work. </p>
  
  <p>In fact, any binding I apply works as long as there is a host name:</p>
  
  <pre><code>https://www.delaneywilson.com -&gt; Works
  https://anything.delaneywilson.com -&gt; Works
  https://something.delaneywilson.com -&gt; Works
  https://delaneywilson.com -&gt; Does not work
  </code></pre>
  
  <p>Everything I've read leads me to believe that wildcard certificates are supported in IIS8.x using CCS, but I cannot make "just" the domain name work. </p>
  
  <p>It says for UCC certificates that you actually have to duplicate the certificate and drop it in the shared directory once for each domain supported by the UCC cert. I tried something similar with the wildcard certificate, but it didn't work. In fact the certificate did not show up at all in the CCS list. (Which is expected since the certificate is *.dealneywilson.com and not delaneywilson.com). I can work-around this problem by just forcing a redirect from my load balance from delaneywilson.com to www.delaneywilson.com, but I think it would be better if it just worked.</p>
  
  <p>For now I've just gone back to installing the certificates on each server and then configuring my bindings to use SNI and my local certificate store. That seems to work without any issues. For a small farm of 5 servers and just a few websites it's not a big deal, but I need to use the CCS for a 24 server web farm hosting 6500 domains and its just too much configuration. </p>
  
  <p>Can anyone confirm that this is a bug in the IIS 8.5 CCS?  </p>