Ssl – Redirect HTTPS With No Cert In Place

httpsiisredirectsslssl-certificate

https:/ /SSLSite.com
http:/ /NoSSLSite.com

I need https:/ /NoSSLSite.com to redirect to https:/ /SSLSite.com . Is this possible? IIS webserver

Back story – We made some major changes recently. But one dept sent paperwork to customer with old site URLS. Those URLs no longer exist and the cert is off the server.

Thanks,

Best Answer

Your https:// site needs a certificate. The SSL negotiation happens before any HTTP exchange takes place. In order to redirect the client you need the browser to successfully establish an SSL connection.

You could use a self-signed certificate, although this will generate errors messages in the browser. You could buy a 1-year SSL certificate which is only a few hundred dollars.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

HTTP to HTTPS redirect with Exchange 2013 OWA

I was able to solve my own problem using IIS Rewrite Mod. I was little confused when found this, since Rewrite Mod is well know in Unix world with the Apache Web Server.

Anyway, just downloaded and installed the IIS Rewrite Mod from here: http://www.microsoft.com/en-us/download/details.aspx?id=7435

And then modify web.config in wwwroot with this XML code:

<configuration> <system.webServer> <rewrite> <rules> <rule name="HTTPS Redirect" stopProcessing="true"> <match url="(.*)" /> <conditions> <add input="{HTTPS}" pattern="off" ignoreCase="true" /> </conditions> <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" /> </rule> </rules> </rewrite> </system.webServer> </configuration>

With this approach I was able to redirect HTTP to HTTPS in Exchange 2013.

And don't forget to disable the "Require SSL" option in the Default Web Site on IIS Control Panel or you'll get and 403 Unauthorised error page.

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

HTTP to HTTPS redirect with Exchange 2013 OWA

Related Topic