Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been hosting a domain on a Win2003 server for the last 3 or 4 years but I now need to make this domain accessible only via https.

I've installed the certificate correctly and it works fine (the server hosts several domains, but for this domain it is hosted on a different public IP address) but I'm struggling to get IIS to just transfer all users who go to to

I've found the "require secure channel" option in IIS, but checking this results in anyone who fails to type the https part to see an error message (below). What's the best way to redirect users to the https site (without the user having to worry about it)?

The page must be viewed over a secure channel The page you are trying to
access is secured with Secure Sockets Layer (SSL). 

Please try the following:

Type https:// at the beginning of the address you are attempting to reach
and press ENTER.

HTTP Error 403.4 - Forbidden: SSL is required to view this resource.
share|improve this question
up vote 5 down vote accepted

Redirecting HTTP to HTTPS using IIS

With SSL enabled, anytime you attempt to access a page via http, the server generates a 403.4 error. IIS is now configured to run your sslredirect.asp page every time this error occurs. The error page will include a querystring which contains the error number and the page causing the error, I.e. "403;". Our ASP file uses a simple script to just trim off the beginning part (430;http), add the necessary "https", and redirect to whatever page the user requested using SSL. Voila!

share|improve this answer

The cleanest way is to have a mod rewrite isapi filter installed. And redirect all http calls to https (or just those for a specific folder/page if you prefer).

Heres an article that explains how to do that + mentions some of the others suggested.

share|improve this answer
I disagree with the first part; many adjectives spring to mind when thinking about the ISAPI version of mod_rewrite, but "clean" isn't one of them. – RainyRat Oct 30 '09 at 15:43

check this kb out.

share|improve this answer

Have your publishing firewall do the redirect. Having calls reaching the actual web server which it has no business dealing with seems unnecessary and may even pose a security risk.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.