1

First up, I'm an IIS7 newbie, so this is probably something obvious.

We've got a new server, with an SSL certificate already installed by our hosting company and visible in IIS manager on the server node.

In the bindings for our site we've got port 443 set up OK with the correct certificate (as far as I can tell).

The problem is, if you connect via a browser using https you're instantly redirected back to http (and then see the site fine). We're trying to put the entire site behind ssl, but if under "ssl settings" we tick "require ssl", your browser is still redirected to http, and then promptly gets a connection refused! (which makes sense kinda)

I've run an IIS SSL diagnostic tool (from Link ) and everything appears OK but I'm not really sure what I'm looking at. I'll post the log only if requested, as it's riddled with server references that I'll have to filter out for security.

Final details - we're using ASP.Net and are using forms auth if that matters any. The server is Windows 2008 SP2 64bit.

4 Answers 4

2

In your IIS settings what is the default document in the root? also it could be possible that the default document has a redirect back to http check the source code of the index file? perhaps during development stages before live? Was this problem always the case or just recently surfaced when adding SSL?

1
  • I'll have a look at this. The default document is "default.aspx", which exists but our CMS system (Sitefinity from teleric) does a bit of url rewriting, and actually intercepts request to root (/) and sends them to a content page.
    – Andrew M
    Oct 31, 2010 at 8:33
0

I would recommend using Fiddler from a remote machine ( http://www.fiddler2.com/fiddler2/ ) and see the sequence of requests that are happening. Most likely is that something in your application is returning a 301 or 302 (Redirect) to it.

Also on the server try enabling Failed Request Tracing with the setting by status code 100-600 and log all content. Then issue the request, you will see on the server the log files that will tell you exactly what is happening: http://learn.iis.net/page.aspx/266/troubleshooting-failed-requests-using-tracing-in-iis7/

2
  • I'm working from memory, but I had a look in Fiddler, and it wasn't a normal 301/302 (that I could tell), you saw a 'connect' (SSL?) with no response, and then simply the normal request. I'll have another look when I get in later. I'll also try the request tracing.
    – Andrew M
    Oct 31, 2010 at 8:31
  • In Fiddler you will need to enable to decrypt SSL traffic in the Options menu, otherwise you will not see the decrypted traffic and only see SSL connection. Oct 31, 2010 at 16:49
0

It turns out the problem was our CMS system, Sitefinity. It has a page property called "use SSL", and if not set (the default), it would explicitly redirect secure requests back to not secure. To fix, in web.config, change the

<cms defaultProvider="Sitefinity" pageExtension=".aspx" disabled="false" pageEditorUIMode="Overlay" sslRedirection="ToHttpsOnly">

The important bit is: sslRedirection="ToHttpsOnly"

0

You should probably remove the http binding on the website in question if you have not already done so. Click on the website, then click Bindings on the right hand side of the screen and just leave https there.

1
  • 1
    Jacob Henley, welcome to Server Fault! Please take notice of the accepted self-answer by AndrewM and the age of the question. Jan 30, 2013 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .