How to enforce/redirect HTTP to HTTPS

Question

I've been hosting a domain on a Win2003 server for the last 3 or 4 years, but I now need to make this domain accessible only via HTTPS.

I've installed the certificate correctly and it works fine (the server hosts several domains, but this domain is hosted on a different public IP address), but I'm struggling to get IIS to just transfer all users who go to http://www.example.com to https://www.example.com.

I've found the "require secure channel" option in IIS, but checking this results in anyone who fails to type the https:// part seeing an error message (below). What's the best way to redirect users to the HTTPS site (without the user having to worry about it)?

The page must be viewed over a secure channel The page you are trying to access is secured with Secure Sockets Layer (SSL).

Please try the following:

Type https:// at the beginning of the address you are attempting to reach and press ENTER.

HTTP Error 403.4 - Forbidden: SSL is required to view this resource.

Solution 1

Redirecting HTTP to HTTPS using IIS

With SSL enabled, anytime you attempt to access a page via http, the server generates a 403.4 error. IIS is now configured to run your sslredirect.asp page every time this error occurs. The error page will include a querystring which contains the error number and the page causing the error, I.e. "403;http://www.whatever.com". Our ASP file uses a simple script to just trim off the beginning part (430;http), add the necessary "https", and redirect to whatever page the user requested using SSL. Voila!

Solution 2

The cleanest way is to have a mod rewrite isapi filter installed. And redirect all http calls to https (or just those for a specific folder/page if you prefer).

http://www.isapirewrite.com/

Heres an article that explains how to do that + mentions some of the others suggested. http://www.iis-aid.com/articles/how_to_guides/three_methods_redirect_http_https

Solution 3

Check out the Microsoft Knowledgebase article How to redirect an HTTP connection to HTTPS for Outlook Web Access clients and how to redirect the Default Web Site to point to the Exchange virtual directory.

There are a few steps to configure this correctly; the code is:

<%

If Request.ServerVariables("HTTPS")  = "off" Then
Response.Redirect "https://" & Request.ServerVariables("HTTP_HOST") & "/Exchange"
End If 

%> 

Comments

[RainyRat]

I disagree with the first part; many adjectives spring to mind when thinking about the ISAPI version of mod_rewrite, but "clean" isn't one of them.

[Admin]

This question was asked in 2009, and the HSTS RFC is from November 2012. Hopefully this Windows 2003 (EOL since July 2015) is not alive anymore.

[Admin]

Ah good point, I hadn't even noticed the date. I came here via google while trying to search for the term 'HSTS' because I had forgotten the name. So I figured at least someone could benefit from this answer.