0

Is it possible to have my website require SSL if it is using Windows Authentication?

So far, I'm not having luck with it.

2
  • Do you want it to require SSL only if Windows authentication is used or do you want SSL to be an always-on thing?
    – Top__Hat
    Nov 18, 2011 at 12:33
  • The site will always be using Windows authentication. SSL should always be in effect. Nov 22, 2011 at 15:25

1 Answer 1

1

If you are always using Windows Authentication and always using SSL then the following should fit the scenario. 1. Rurn off all other forms of authentication in IIS. 2. Setup a redirect site in IIS to redirect all HTTP traffic to the HTTPS site (on the same server).

This forces all HTTP traffic over to SSL and only allows for Windows authentication.

Note this may behave strangely for non-IIS browsers due to how Windows Authentication works.

6
  • The steps above should get you what you need. This is a pretty standard setup.
    – Tatas
    Nov 22, 2011 at 18:35
  • I had already tried that. Weird thing is, the site won't load/render at all with https if it's using Windows authentication. We're using a self-signed certificate by the way. Nov 22, 2011 at 20:17
  • What browser(s) are you using? Does it work with anon access?
    – Top__Hat
    Nov 22, 2011 at 20:30
  • Internet Exploder. It does work with anonymous, and non-SSL. But since I have never tried SSL with Windows auth, I thought that maybe it wasn't even possibe (or even redundant). If you're sure it should work, it must be a problem with my SSL certificate. Nov 22, 2011 at 20:43
  • Does the client trust the self-signed cert?
    – TristanK
    Nov 23, 2011 at 6:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .