Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

First up, I'm an IIS7 newbie, so this is probably something obvious.

We've got a new server, with an SSL certificate already installed by our hosting company and visible in IIS manager on the server node.

In the bindings for our site we've got port 443 set up OK with the correct certificate (as far as I can tell).

The problem is, if you connect via a browser using https you're instantly redirected back to http (and then see the site fine). We're trying to put the entire site behind ssl, but if under "ssl settings" we tick "require ssl", your browser is still redirected to http, and then promptly gets a connection refused! (which makes sense kinda)

I've run an IIS SSL diagnostic tool (from http://blogs.msdn.com/b/vijaysk/archive/2009/09/20/ssl-diagnostics-tool-for-iis-7.aspx ) and everything appears OK but I'm not really sure what I'm looking at. I'll post the log only if requested, as it's riddled with server references that I'll have to filter out for security.

Final details - we're using ASP.Net and are using forms auth if that matters any. The server is Windows 2008 SP2 64bit.

share|improve this question
add comment

4 Answers

In your IIS settings what is the default document in the root? also it could be possible that the default document has a redirect back to http check the source code of the index file? perhaps during development stages before live? Was this problem always the case or just recently surfaced when adding SSL?

share|improve this answer
    
I'll have a look at this. The default document is "default.aspx", which exists but our CMS system (Sitefinity from teleric) does a bit of url rewriting, and actually intercepts request to root (/) and sends them to a content page. –  Andrew M Oct 31 '10 at 8:33
add comment

I would recommend using Fiddler from a remote machine ( http://www.fiddler2.com/fiddler2/ ) and see the sequence of requests that are happening. Most likely is that something in your application is returning a 301 or 302 (Redirect) to it.

Also on the server try enabling Failed Request Tracing with the setting by status code 100-600 and log all content. Then issue the request, you will see on the server the log files that will tell you exactly what is happening: http://learn.iis.net/page.aspx/266/troubleshooting-failed-requests-using-tracing-in-iis7/

share|improve this answer
    
I'm working from memory, but I had a look in Fiddler, and it wasn't a normal 301/302 (that I could tell), you saw a 'connect' (SSL?) with no response, and then simply the normal request. I'll have another look when I get in later. I'll also try the request tracing. –  Andrew M Oct 31 '10 at 8:31
    
In Fiddler you will need to enable to decrypt SSL traffic in the Options menu, otherwise you will not see the decrypted traffic and only see SSL connection. –  CarlosAg Oct 31 '10 at 16:49
add comment
up vote 0 down vote accepted

It turns out the problem was our CMS system, Sitefinity. It has a page property called "use SSL", and if not set (the default), it would explicitly redirect secure requests back to not secure. To fix, in web.config, change the

<cms defaultProvider="Sitefinity" pageExtension=".aspx" disabled="false" pageEditorUIMode="Overlay" sslRedirection="ToHttpsOnly">

The important bit is: sslRedirection="ToHttpsOnly"

share|improve this answer
add comment

You should probably remove the http binding on the website in question if you have not already done so. Click on the website, then click Bindings on the right hand side of the screen and just leave https there.

share|improve this answer
1  
Jacob Henley, welcome to Server Fault! Please take notice of the accepted self-answer by AndrewM and the age of the question. –  Deer Hunter Jan 30 '13 at 17:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.