I secured a site for my employer recently and ran into an issue. By requiring an SSL connection users were forced to enter https at the beginning of the website address. Those that did not were greeted with an error telling them to add https in order to reach the page. I had done this before with a little ASP and a custom error message but, after migrating the web server to a new machine was unable to get my original configuration to work.

Run a search on this and you will find 10 million ways to accomplish the redirect. I was unable to get most of them to work. I didn't realize that the easiest way is to perform the redirect completely with IIS config.

I simply set the site in question to require an SSL connection but, change the TCP port to one that is unused. Next create a new page (for the redirect) and configure it to use port 80. Once done, enter the page properties and set the content to come from "A redirection to a URL" and enter https://yourpageaddress.com. Restart IIS and you should be good to go. I spent way too much time on this when it was really something simple. Thanks to James Kovacs Weblog for the best article on the subject I've found.

Labels: IIS