I am facing problem redirecting my HTTPS web service from HTTP.

I have applied CA SSL certificate to my web service and using URL Rewrite, I have done the changes for redirection in IIS 7.5.

Here is the configuration I got in to my web.config:

<rule name="Redirect to HTTPS" stopProcessing="true">
  <match url="(.*)" />
    <add input="{HTTPS}" pattern="^OFF$" />
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />

But with out uncheck the Require SSL for my webservice, I can not redirect from HTTP to HTTPS, where I get a 403.4 error.

When I tried to add an error page with 403.4 code, it is not accepting it and saying that we can not add 403.3 code. It only accepts 403, 404, etc.


The "Require SSL" checkbox is exactly what causes all regular HTTP requests to get a HTTP 403 back. Unchecking it does not "break SSL" or anything like it, it just allows IIS to serve a response for HTTP requests

There are 2 approaches to this:

  1. Uncheck the "Require SSL" checkbox on the website and rewrite all HTTP requests with URL Rewrite
  2. Keep the "Require SSL" setting on
    • Remove all non-HTTPS bindings from the website
    • Create a new dummy website with the HTTP bindings you removed from the real website
    • Use URL Rewrite to redirect all requests from the dummy site to the real website over https

The first approach is the easiest to implement and maintain, but the second option provides an extra safeguard in that IIS will throw an error (instead of serving non-http content) if the URL Rewrite module should fail for any reason

  • Thanks for the approaches.!! Here the reason why i am implementing the HTTP redirection is , we have implemented the web service with HTTP and no SSL. The URL are hardcoded in the client application and many users are using it. Now we would like to implement the HTTPS by applying a SSL certificate. So i implemented URL rewrite and uncheck the Require SSL which wont give a 403 error. The only thing i am worrying about is that uncheck SSL causes any drawback of implementing SSL ? Please clarify me.. – user3056216 Aug 2 '14 at 3:48
  • Any chance you would know why the SSL Required has to be unchecked for the URL Rewrite from HTTP > HTTPS to work? – Joseph Casey Mar 30 '15 at 14:02
  • 1
    @JosephCasey Because IIS would otherwise respond with HTTP 403, and not allow you (you = the rewrite module), to rewrite the request. In other words, when IIS receives a request, it first looks at whether the request is allowed and conforms to its expectations, before anything else is allowed to take place – Mathias R. Jessen Mar 30 '15 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.