IIS 10 HTTPS站点绑定新增选项功能及影响咨询

Hey there! I totally get the frustration of hunting down clear docs on these IIS 10 HTTPS binding flags—they’re not always well-documented. Let me break down the most common ones for you, along with their practical impacts:

• Require SNI
  This flag forces your site to only accept HTTPS requests that include a Server Name Indication (SNI) header. SNI lets the web server know which domain the client is trying to reach during the TLS handshake, which is critical if you’re hosting multiple HTTPS sites on the same IP address. Without SNI enabled, IIS would just serve the default certificate for that IP, leading to certificate mismatch errors for all non-default sites. Most modern browsers support SNI, so compatibility issues are rare these days—this is a must-have for multi-site setups on a single IP.

• Disable HTTP/2
  By default, IIS 10 enables HTTP/2 for better performance (faster load times, multiplexed requests). This flag turns that off, forcing the site to only use HTTP/1.1. You’d want to enable this only if you’re dealing with legacy clients or middleware (like old load balancers) that don’t support HTTP/2, or if you’re troubleshooting odd issues that trace back to HTTP/2 quirks. Generally, though, HTTP/2 is better for performance, so leave this off unless you have a specific reason.

• Enable HTTP/3
  Available in newer IIS 10 versions (like those on Windows Server 2022), this flag turns on HTTP/3, which uses the QUIC protocol instead of TCP. HTTP/3 offers faster handshakes and better resilience on unstable networks (like mobile connections) because QUIC is built on UDP. Clients that support HTTP/3 (modern Chrome, Edge, Firefox) will automatically use it, while older clients will fall back to HTTP/2 or HTTP/1.1. Just make sure your server’s UDP port 443 is open, and your certificate is properly configured.

• Negotiate Client Certificate
  This controls how IIS handles client-side TLS certificates:

  • Required: The site will reject any request that doesn’t include a valid client certificate—great for internal or secure sites where you need to verify user identity via certificates.
  • Accept: IIS will ask for a client certificate, but won’t block requests if none is provided. Useful if you want optional certificate-based auth alongside other methods.
  • None: IIS won’t request or require client certificates at all—standard for public-facing sites that don’t need client-side auth.

• Use Centralized Certificate Store (CCS)
  Instead of binding a unique certificate directly to the site, this flag tells IIS to pull the certificate from a centralized store (like a network file share or Azure Key Vault). This is a huge time-saver if you manage dozens of HTTPS sites—you can update or renew certificates in one place instead of editing each site’s bindings individually. Just note that you need to set up and configure the CCS first before using this option.

备注：内容来源于stack exchange，提问作者Mark de Wet