iis 6 - ISA Server 2006 SSL Certificate Dilemma

I'm making so great headway in offering our services over https with help from a Go Daddy certificate, later to be upgraded to Thawte SSL123 certs. But, I've just run into one whopper of a problem.

Here's my setup: I run an ISA 2006 firewall. Our web services are distributed over 2 servers. One is Windows 2000 (www.domain.com) and the other is Windows 2003 (services.domain.com). So, I'll need to purchase 2 certs for both www and services, import them into IIS6 on their respective machines, then export them with the primary key (making sure to Include all certificates in the certification path if possible... that had me stumped for a while), and then to finally import them into ISA's local computer Personal store. The problem I've just run into is that I have separate firewall rules for services.domain.com and www.domain.com... because requests need to be forwarded to different web servers. Each of these firewall rules use the same httplistener. I have just found out that you can only use 1 certificate per httplistener. To make matters worse you can only have a single httplistener per ip / port. Is this correct? I can only use a single certificate for a single ip address? This would seem to be a severe limitation. Am I wrong? If I'm not then I've got a whole lot more work ahead of me as I'll have to set up extra ip's, add them to the firewall's network interface, create new listeners using that ip, etc...

Can someone please confirm that I'm doing this correctly / incorrectly? Once I got my head wrapped around it all it seemed easy... then this.

Thanks in advance.

Edit: To explain what I believe I have to do now is: set up www.domain.com to use one ip address and set services.domain.com to use another ip address. Then create separate httplisteners (well... create one because one already exists) for each. One with the www cert installed, the other with the services cert installed. How does this sound?

Answer

I didn't think you had to specify an IP address for a weblistener, which would force it to use host headers and perform your mapping that way.

Otherwise, you might want to think about a wildcard certificate (*.domain.com)