I am setting up SSL certificates on a development environment using IIS 6 on W2k3.

I have a directory called login with a single page login.asp which I would like only viewable over SSL.

So before installing or applying SSL permissions, the page is viewable through a browser. I can browse the page and it redirects etc. and all is good. However Basic Authentication is Base64 encoded so I want to secure the traffic from this page only.

I have created a dummy certificate in makecert, installed it and added it to IIS. IIS is happy that it is trusted. I have selected the directory of login and child files to "Require SSL channel". When I refresh my browser on login/login.asp I get a "404: Page Not Found" in IE 8. So 2 issues here

  1. The page is now unviewable when using HTTPS.
  2. They must manually type the HTTPS (minor inconvenience for now)

If I turn off "Require SSL Channel" from IIS, it works again.

What part of the process am I missing as I have followed several tutorials on installed SSL certificates, but still come across this barrier.


Now I have investigated this problem a lot more thoroughly, I thought I'd respond.

The problem is that the page now expects to only be requested as HTTPS. If you require to automatically switch to HTTPS when requesting HTTP, I did this by forcing any 401.3 errors (in the Custom Errors tab of the site) to a specific URL, which then changed the http:// to https:// for any incoming request.

Looking at articles on Google, you can either do it in a ASP/.NET etc or Javascript.

Also I found the selfssl.exe in the IIS 6.0 Resource Kit to be much more user friendly than makecert.exe. Very very simple to use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.