No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

No need to enable SNI for multiple SSL sites on same IP but using same wild card certificate?

I have an IIS server hosting: mydomain.com sub1.mydombain.com sub2.mydomain.com They are listed as 3 separate sites under IIS, all bind to the same IP over HTTPS on 443. But they all use the same SSL certificate which is a wild card certificate covering .mydomain.com In this scenario, my understanding is that SNI isnt necessary, because whichever certificate the server serves for any request which is the same certificate will work for all sites anyway, correct I tested it myself and it seems to be working, but I just want to make sure doing so wont cause any unexpected ill results for certain users I do not want to use SNI if possible because I do want Windows XP support for these sites Out of curiosity, I do want to know when you have a setup like this multiple sites over SSL on same IP but not enable SNI, how exactly does IIS decide which certificate to serve the first 443 binding on an IP Or the last one used Furthermore, if this setup works, in the future if I were to add mydomain2.com into the same IIS server, and using a different SSL certificate, can I enable SNI for mydomain2.com only and not affect the other 3 sites Thanks.