HTTP to HTTPS redirects on IIS 6.x and higher (HTTPS Force)

This is the most common requirement on most of the Exchange servers hosted on IIS. The server admins configure an http to https redirect.

Today I will be discussing few ways of doing this. I will keep updating this document as I find more ways to do so. I am considering OWA as a sub application under IIS for all the below examples. Here is the structuring of the Web Site:

In this case, we want the requests (HTTP ) to be redirected on HTTPS to the application called “OWA” under the Default Web Site.

For this you will have to install the URL Rewrite module. (FYI, this is available for IIS 7 and higher only.)

Download from here: http://www.iis.net/downloads/microsoft/url-rewrite

Once installed, the URL Rewrite module would be listed under IIS section. There are few articles out there on this. Here are few to list:

  1. http://www.sslshopper.com/iis7-redirect-http-to-https.html
  2. http://www.jppinto.com/2010/03/automatically-redirect-http-requests-to-https-on-iis7-using-url-rewrite-2-0/

These articles are definitely a great repository, however I observed that they have not addressed an important factor.

As specified in the above links add the below section in the web.config at the root of the site:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <configuration>
 <system.webServer>
 <rewrite>
 <rules>
 <rule name="Force HTTPS" stopProcessing="true">
 <match url="(.*)" />
 <conditions>
 <add input="{HTTPS}" pattern="^OFF$" />
 </conditions>
 <action type="Redirect" url="https://{HTTP_HOST}/{R:0}" redirectType="Permanent" />
 </rule>
 </rules>
 </rewrite>
 </system.webServer>
 </configuration>
NOTE: Ensure the rewrite rule is disabled at each of the virtual directories/applications under the Default Web Site. Due to inheritance, the rule will cause the requests to end up in infinite loop calling itself repeatedly.
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s