URL redirect not working in IIS 7.5

Question

I am facing problem redirecting my HTTPS web service from HTTP.

I have applied CA SSL certificate to my web service and using URL Rewrite, I have done the changes for redirection in IIS 7.5.

Here is the configuration I got in to my web.config:

<rule name="Redirect to HTTPS" stopProcessing="true">
  <match url="(.*)" />
  <conditions>
    <add input="{HTTPS}" pattern="^OFF$" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />
</rule>

But with out uncheck the Require SSL for my webservice, I can not redirect from HTTP to HTTPS, where I get a 403.4 error.

When I tried to add an error page with 403.4 code, it is not accepting it and saying that we can not add 403.3 code. It only accepts 403, 404, etc.

Solution

The "Require SSL" checkbox is exactly what causes all regular HTTP requests to get a HTTP 403 back. Unchecking it does not "break SSL" or anything like it, it just allows IIS to serve a response for HTTP requests

There are 2 approaches to this:

1. Uncheck the "Require SSL" checkbox on the website and rewrite all HTTP requests with URL Rewrite
2. Keep the "Require SSL" setting on
   • Remove all non-HTTPS bindings from the website
   • Create a new dummy website with the HTTP bindings you removed from the real website
   • Use URL Rewrite to redirect all requests from the dummy site to the real website over https

The first approach is the easiest to implement and maintain, but the second option provides an extra safeguard in that IIS will throw an error (instead of serving non-http content) if the URL Rewrite module should fail for any reason

Comments

[user3056216]

Thanks for the approaches.!! Here the reason why i am implementing the HTTP redirection is , we have implemented the web service with HTTP and no SSL. The URL are hardcoded in the client application and many users are using it. Now we would like to implement the HTTPS by applying a SSL certificate. So i implemented URL rewrite and uncheck the Require SSL which wont give a 403 error. The only thing i am worrying about is that uncheck SSL causes any drawback of implementing SSL ? Please clarify me..

[Joseph Casey]

Any chance you would know why the SSL Required has to be unchecked for the URL Rewrite from HTTP > HTTPS to work?

[Mathias R. Jessen]

@JosephCasey Because IIS would otherwise respond with HTTP 403, and not allow you (you = the rewrite module), to rewrite the request. In other words, when IIS receives a request, it first looks at whether the request is allowed and conforms to its expectations, before anything else is allowed to take place