Groups | Blog | Home
all groups > iis security > september 2004 >

iis security : change http to https



John McClain
9/28/2004 1:18:05 PM
A few questions...
1) I have set up a virtual directory under the default web site called
Acuity that points to my web application. I have setup up the Acuity
directory to 'require Secure channel' on the 'Directory Security' tab after
Rclicking on Acuity and choosing properties. I am noticing that I can get
into the site EITHER via http or https. However, If I setup the 'Require
Secure Channel' setting on the default web site, I can only get in via
https. How do I configure IIS to apply SSL to only Acuity instead of the
Default Web Site???


2) After getting Acuity to be SSL enabled, How do I set it up so that if a
person tries to Access Acuity via http, IIS redirects them into https. For
example, http://localhost/Acuity gets redirected to https://localhost/Acuity


Miha Pihler
9/28/2004 10:32:09 PM
Hi John,

I am not sure which version of IIS you use so these answers is for latest
IIS (IIS 6 that comes with Windows 2003 server).

If you setup virtual directory, you have an option to not require SSL on
Default Web Site and just require it for your virtual directory. If user
will enter http://localhost this will work and so will https://localhost.
IIS will not require user to switch to https...

Now right click on your virtual directory -> properties -> directory
security -> click Edit button under Secure Communications and select Require
secure channel (SSL). Any user accessing http://localhost/virt_dir will be
notified that he/she must use https://

For SSL redirections try solutions provided in these Microsoft articles:

How to: Redirect an HTTP connection to HTTPS for Outlook Web Access (OWA) in
Exchange 2003 Server.
http://support.microsoft.com/default.aspx?scid=kb;en-us;555126

HOW TO: Use ASP to Force SSL for Specific Pages
http://support.microsoft.com/default.aspx?scid=kb;en-us;239875

If these redirection won't work for you let me know, there are few other
options...

I hope it helps,

Mike

[quoted text, click to view]

John McClain
9/29/2004 11:00:51 AM
Thanks for the help - the asp redirector page works great. However,
Concerning question 1 - When I setup SSL required on VDir, it STILL allows
me to
enter the site as either http or https. But, when I set SSL required on the
Default web site (the parent of the VDir), It works as expected and I get a
SSL required error when trying to enter as http. Why cant I just set SSL
required on my VDir instesad of the parent???

[quoted text, click to view]

Miha Pihler
9/29/2004 8:15:59 PM
<snip>

[quoted text, click to view]

Sorry, I wouldn't know. I tried it on my test system and it works...

Check your event logs (application and system) to see if there are any
errors....

Mike

<snip>

AddThis Social Bookmark Button