This topic, creating a mechanism for redirection from HTTP to HTTPS on a Windows 2008 server running IIS 7.0 is a much written-about topic on the Internet. How this is done is really not so much my issue. My issue is more of explaining why this can't be done with the standard HTTP Redirect module that ships with Windows 2008 IIS 7.0. Instead, there are other methods needed that are more arduous.

First, the IIS 6.0 method requires no externally available modules nor does it require any additional modifications to the web.config or any type of other development effort. It's outlined here: http://blogs.microsoft.co.il/blogs/dorr/archive/2009/01/13/how-to-force-redirection-from-http-to-https-on-iis-6-0.aspx And, you can see the basic steps are to run the snap-in, get the properties on the site, and do some modifications. Presto, you have the HTTP --> HTTP redirect setup.

Now, on the IIS 7.0 platform, it doesn't seem this simple. An initial search found the following site: http://www.sslshopper.com/iis7-redirect-http-to-https.html Which has two separate approcates: 1. Involves installing a separately available Microsoft module -- URL Rewrite Module, and then adding XML to the web.config. 2. Custom Error Page. ...there might be other methods, but these are the basic ones and the first is listed as the primary method.

But wait...There exists on the IIS 7.0 an HTTP Redirect Module. So...why can't I use the HTTP Redirect Module to do this very thing?

This is really my big question. I need to know this because my management is going to insist I use the HTTP Redirect Module and set up the HTTP to HTTPS redirect in a similar fashion to how we do in IIS 6.0.

Can someone please explain to me, in clean, simple, easy to understand, terms that both I and my management can understand as to why I need to go get the URL Rewrite Module and install that on the server and make the web.config changes suggested by the article instead of simply using the HTTP Redirect module that's already installed on the site?

Thanks a bunch.

  • Perfect. This is extremely helpful. We can modify the web.config. That's not the problem so much as telling my boss, "No, you can't do it the way you told me to do it. We have to do it this way which involves all this other stuff." Plus, getting anything installed on these servers is a pain. – Dan7el Nov 16 '12 at 19:16

The built-in HTTP Redirect module's only purpose in life was to return 300 series error codes to tell the browser to go somewhere else. Theoretically you could setup a 301 or 302 to send traffic to HTTPS, however this requires a lot of overhead, specifically:

  1. A separate site to receive only the HTTP requests
  2. A rule to redirect the traffic, this doesn't always handle querystrings, etc.
  3. A second site to only receive HTTPS requests

As opposed to the new module (which in IIS 8 is the default) that allows you to run rules for the site in a much more specific manner and gain much better control over traffic routing and transformations.

As for your concern about modifying the web.config file directly there are ways around that but I can't locate my source on that right now. Essentially, you can store the rewrite config at the website config location as opposed to the application level.

  • Machine (machine.config)
  • Server (ApplicationHost.config)
  • Website
  • Application (web.config)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.