Iis – HTTP to HTTPS rewrite causing “too many redirects” error

iisrewrite

I'm trying to do a redirect from http to https on IIS 8.5 for a specific site. I followed the instructions here (and here), copying the exact web.config file in the answer. I'm getting a, "too many redirections", error in all browsers when the top rule is enabled. Disabling that rule stops the error.

The site "bindings…" has both ports 80 and 443 configured and a valid cert is assigned to the 443 binding. The 'URL Rewrite' module is installed.

This Win 2012 VM is behind an F5 load balancer which I have no access to other than opening tickets to the data center.

The goal is to redirect all http requests to https for this particular site. This site is just a test site with a static index.html document.

The exact web.config is this:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="HTTP to HTTPS redirect" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                        redirectType="Permanent" />
                </rule>
            </rules>
            <outboundRules>
                <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
                    <match serverVariable="RESPONSE_Strict_Transport_Security"
                        pattern=".*" />
                    <conditions>
                        <add input="{HTTPS}" pattern="on" ignoreCase="true" />
                    </conditions>
                    <action type="Rewrite" value="max-age=31536000" />
                </rule>
            </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>

Best Answer

My IIS servers are behind an F5 load balancer which was causing this. I had the Data Center manage all redirection from http to https on their end.