Elegantly Enforcing SSL in IIS 6.0

Question

I have a website running under IIS which has an SSL certificate applied. We would like to enforce HTTPS usage for the website which is easily done by checking the "Require Secure Channel" box, but this will immediately break the ability for people to connect over HTTP (as designed).

What I'd like to do is find a way to automatically redirect people from HTTP -> HTTPS if they type in the wrong thing (or connect from an old bookmark).

Is there a way to do this without creating a second website in IIS?

score 8 · Answer 1 · edited May 23 '17 at 11:33

8

I posted this on StackOverflow

If the server/site/vdir is configured using the "Require Secure Channel" setting, the response from the server will be a "403.4 Forbidden: SSL is required to view this resource." error or a "403.5 Forbidden: SSL 128 is required to view this resource.".

You can actually customize the 403.4 or 403.5 error to redirect back to HTTPS. Create a VDIR under your site with NO SSL Requirement (**This is Important) - I use "CustomError". Create an ASP File inside this directory called 403_4_Error.asp containing the following:

<%@ LANGUAGE="VBScript" %> 
<%
if Request.ServerVariables("HTTPS") <> "on" then
    sServer = Request.ServerVariables("SERVER_NAME")
    sScript = Request.ServerVariables("SCRIPT_NAME")
    sQuery  = Request.ServerVariables("QUERY_STRING")
    Response.Write("https://" & sServer & sScript & "?" & sQuery)
end if
%>

Edit the server/site/vdir's Custom Error property for 403.4/403.5 and set the MessageType to URL and the URL to "/CustomError/403_4_Error.asp".

Note that ASP is used, you could easily use ASP.net or any other scripting language.

edited May 23 '17 at 11:33

Community

1

answered May 20 '09 at 22:04

Christopher_G_Lewis

3,685
22
27

This is the method we use. – sysadmin1138 May 20 '09 at 22:17
Thanks for that. I really was looking for a server-side (non-code specific) solution for this as we're marking the entire domain as requiring SSL. I'll keep this in mind for any future apps. – kdmurray May 20 '09 at 22:28
1

This is completely server side - it executes in the server's error page handler. – Christopher_G_Lewis May 20 '09 at 22:40
+1 never thought of using the error page to do this. Very elegant. – Jimmie R. Houts May 20 '09 at 22:54
+1 for this, it's extra easy to do in IIS7 as you can specify a redirect straight from the error customisation page – Whisk May 20 '09 at 23:03
Actually this trick is also documented in KB 839357. http://support.microsoft.com/kb/839357 – Lex Li Jun 08 '09 at 12:17
Yes, I believe I started with that article - Exchange was the initial premise for our needs. The above script will work with any site, not just Exchange OWA. – Christopher_G_Lewis Jun 08 '09 at 15:05

Jimmie R. Houts · Accepted Answer · 2009-05-20T21:48:49.187

3

If you need to do it at the server level then you will have to create another site and have it forward the the https site.

If you can edit the code, you can not enforce ssl at the server level, instead you can do it in your website by detecting if the url starts with http: and redirecting to the same url with https: instead.

edited May 20 '09 at 21:48

answered May 20 '09 at 21:34

Jimmie R. Houts

1,853
1
15
12

Editing the code won't help since the request will never make it to the code if the https is enforced at the IIS level. – Ryan Bolger May 20 '09 at 21:38
2

However, if the flag is turned off (allow http), their code WILL run and redirect cleanly. – sysadmin1138 May 20 '09 at 21:43
@Ryan, sysadmin1138 is correct, I have updated my answer to be more clear. – Jimmie R. Houts May 20 '09 at 21:51
OK. Thanks. I pretty much figured that was the answer. I'd really love to see an "auto-forward" feature in IIS 8 to make this sort of thing automatic. Seems a waste to clog up the IIS metabase with extra sites that are simply redirects. – kdmurray May 20 '09 at 22:00
As for the code option, the HTTP variant of the site needs to be turned off, that's the whole reason for needing to enforce SSL to begin with. Simply doing a redirect in code (unless it's done at a high level so that it happens on any page) could potentially allow for bookmarked pages to be viewed over the insecure link. – kdmurray May 20 '09 at 22:06

score 0 · Answer 3 · answered Jun 02 '09 at 17:09

We ended up doing this in our application code; our page base class checks early on whether it's in HTTP, and redirects to HTTPS as required. It really depends on how much you trust your application code :)

Elegantly Enforcing SSL in IIS 6.0

3 Answers3