Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I think our backend programmer/server admin is handling our SSL redirects pretty wonky - see it in action here:

  1. First off, see how it redirects to index2.asp? Is this necessary? Can't she easily redirect to the original index.asp but have it be https:// instead?

  2. Also, she is using a meta refresh on the original index.asp page to redirect to index2.asp as well, and she says this is for backup, in case the server configs change and the server can't handle the redirect so then the webpage would take over.

  3. Finally, she said she tried using the server redirect solely but that it kept looping on itself- what did she do wrong? Is this even possible?

Is she giving us a snow job or what? I want a better understanding of what is happening here so I can talk to my boss about it, because this is driving me up the wall. Thanks for any info you can provide.

share|improve this question

Yeah, that's basically a snow job. Install the IIS REdirect add-on. Setup a rule, match (.*) if {HTTPS} is off then redirect 301 to https://{HTTP_HOST}/{R:1}. If you only want certain directories, then it gets a touch more complicated (but it's just regex, so nothing Earth shattering).

If it's looping then the server isn't checking for HTTPS being on/off. Meta-refresh is not a good idea in general, the page is sent unecrypted, and while it's probably just a redirect page, still not a good idea "in case the website changes". Sounds like she really doesn't know what she's doing.

share|improve this answer

Pherhaps more of a question for

I don't know the reason she did it that way but in classic ASP which you seem to use a redirect to SSL could be done like this:

It should also be enough for your needs to just have the form go over SSL.

share|improve this answer

We do a redirect to a HTTPS site purely in IIS. We created an IIS entry for the non-secure site. Under the Home Directory tab, we set up a permanent redirection to the https:// site. Then, we set up a separate website entry on the same box, using a fake port 80 host header and the correct SSL-protected site.

Site 1, 
redirect (301)
Site 2, https:/ (also http://foobar)
share|improve this answer
That's one overly complicated way of doing it. You could also require SSL on the site, and setup a custom error page that redirect to the HTTPS version; that's a common hack. – Chris S Sep 8 '11 at 3:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.