Different file locations for http v https on IIS?

Question

We have a server running IIS and have some folders running under https, but most are open. The problem I'm having is when someone is directed from a page in the secure section of the site, the relative link brings up https. For example:

link to

/pictures

goes to

http://www.mysite.com/pictures

But if someone is on a secured part of the site

https://www.mysite.com/shoppingcart

And then clicks back to /pictures, they get

https://www.mysite.com/pictures

so the pictures directory is shown under https. My problem is, they get a 404 not found message when this happens.

I could not find anything in the settings that would indicate that secured connections are pulling files from anywhere different than non-secured. If I type http or https on the main page of the site both come up fine. But if I try to add the https:// in a folder level, I get a 404.

Any ideas why this might be happening?

Answer 1

If I understand you correctly, https://www.mysite.com/pictures throws a 404, but http://www.mysite.com/pictures doesn't. And, https://www.mysite.com works.

Your links from your website are relative so if they visited by coming to http, the links are http, otherwise they are https. That part I assume is what you want.

So, for the 404 errors in a subfolder, that's not the default behavior.

Can you tell if it's a true 404 error, or if there is a sub-status code? The browser window may show when it fails, otherwise check the IIS logs.

Failed Request Tracing is a good way to see what's happening too.

I can't guess what would cause this, so my suggestion is to try breaking this down to the smallest part. i.e. follow those links directly without considering the HTML in the page and see if you can repro it. Then the issue may be come more obvious.

Answer 2

Make sure that both Http:// and https:// are indeed the same website. You can easily have two websites setup in IIS where one listens to http traffic (port 80) and one listens to https traffic (port 443 with SSL Certificate installed). If IIS Manager lists more than just the "Default Website" under the websites section then you may have separate websites for HTTP and HTTPS traffic. You should also check to see if SSL is configured for just one folder of the website or for the entire domain. SSL is configured by right clicking on the website or folder in IIS Manager and selecting the "Directory Security" tab and changing the "Secure Communications" settings.