Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to redirect anyone visiting a HTTPS page to a HTTP page however the rule seems to fail and not redirect the user at all i.e. displays an untrusted connection and if I accept the untrusted connection it returns a 404 page. The page I am attempting to redirect to exists.

Is there a way I can redirect a user from HTTPS to HTTP? The rule I have is

    <rule name="Redirect to https">
      <match url="(.*)" />
        <add input="{SERVER_PORT}" pattern="443" />
      <action type="Redirect" url="{R:1}" />
share|improve this question
up vote 2 down vote accepted

There are a couple things to keep in mind. The request must first bind to the server before the redirect, so you can't avoid the untrusted connection except to make sure that you have a valid cert bound to the site. So a redirect won't help with that.

Your redirect url has https:// in it. Did you mean for it to be http://? It should target http.

And if you want to allow some pages to not redirect (like your login page), then you can add exclude conditions for {URL}, or do it in the match url="" section.

share|improve this answer
Thanks and you are correct that it needs to redirect to HTTP. I have updated my question. I know that the request will need to bind to the server first before redirecting but is there anything I can do before it hits the server to redirect? Can you show me an example of how I can exclude URLs? – PeanutsMonkey Jul 20 '11 at 17:56
@PeanutsMonkey 1) For detecting HTTPS usually {HTTPS} variable is used instead of {SERVER_PORT} (but this, actually, depends on circumstances): <add input="{HTTPS}" pattern="on" />. This allows to have rule working even if HTTPS is bound to non-standard port (other than 443). 2) This condition will tell IIS to NOT redirect if /login.php page is requested: <add input="{REQUEST_URI}" pattern="^/login\.php$" negate="true" />. You can add few of such exclusions as separate conditions or merge them into 1 if that is possible. – LazyOne Jul 20 '11 at 19:19
@LazyOne - Thanks LazyOne. What is the difference between {SERVER_PORT} and {HTTPS}? Also is there a way to intercept the request before the SSL handshake? The reason I ask is because the requested URL does not have a SSL certificate seeing that the domains have changed and instead need to redirect the user to the appropriate page. – PeanutsMonkey Jul 20 '11 at 20:08
@PeanutsMonkey 1) {SERVER_PORT} checks for specific server port while {HTTPS} checks if HTTPS on or off regardless of port number. 2) No -- HTTP part of HTTPS kicks in when Secure Channel already established. You cannot intercept it with URL Rewrite as it simply occurs AFTER SSL negotiation. – LazyOne Jul 20 '11 at 20:26
@PeanutsMonkey, I can only +1 LazyOne's replies. That's exactly correct. You can consider wildcard certs, or in IIS7, you can have multiple certs per site. (in IIS6 you can just setup redirect sites with unique bindings). I haven't tried them yet but recently announced free certs. – Scott Forsyth - MVP Jul 20 '11 at 20:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.