Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a website running Windows Server 2003 and IIS 6 and I've got an SSL certificate.

Our website order form is encrypted with that SSL certificate, but the login form is not.

Is this something that needs to be fixed in the code behind the page or can it be fixed in the administration of the server or the installation of the SSL certificate?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You don't need to add any code to your application, once you go through https protocol, every information is encrypted, not just some of them.

you maybe have to check out for some links that could be link the user to http protocol, but you can avoid it redirecting all http request(port 80) to https (port 443) on the server side, for example setting the virtual host on your apache configuration on the https port.

EDIT: here's the steps
1. Open the Computer Management snap-in on your Exchange server. Expand the Services and Applications node, then the Internet Information Services node.
2. Expand the Default Web Site node, then find the Exchange directory. Right-click it and choose the Properties command.
3. Click the Directory Security tab. In the Secure Communications control group, the View Certificate and Edit buttons should be active. If they're not, your certificate isn't installed properly—you'll have to fix it before proceeding.
4. Click the Edit button in the Secure Communications group. You'll see the Secure Communications dialog box.
5. Check the "Require secure channel (SSL)" checkbox. You can optionally check the "Require 128-bit encryption" box as well. Doing so gives you better security, but some clients may not be able to connect.

share|improve this answer
    
@Own3r Well I'm a novice user can you tell me how to redirect my Login form http request to https request, so that it goes through secure connection. –  droidlabour Dec 25 '12 at 15:59
    
You don't need to redirect the form itself action, but just the protocol which you use to access the form page. If the page with the login form is http:(double slash)www(dot)myloginform(dot)com you just have to access it by https:(double slash)www(dot)myloginform(dot)com , and the information are encrypted, obviously the server need to be configured to use the ssl protocol, but from what you said it should be. –  0wn3r Dec 25 '12 at 16:02
    
@Own3r yeah could you please provide some guide of enforcing IIS to use SSL Protocol. –  droidlabour Dec 25 '12 at 16:09
1  
You can use the URL rewrite module, IIS isn't my choice, so I've never do it but its quite simple and I can provide this link that contain a nice guide with screenshots sslshopper.com/iis7-redirect-http-to-https.html , You can follow the method 1 to achieve that –  0wn3r Dec 25 '12 at 16:14
    
You can follow the five steps that I added in my answer –  0wn3r Dec 25 '12 at 16:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.