Is there a way to see what the IIS 8.5 server does when I access a site via HTTPS from an external network? What does it open, what folder structure, which file?

I'm asking this because when I access my sites via HTTPS from external I always get redirected to the IIS Default Page, even though I stopped the default web site in IIS and deleted all html-files which are in inetpub/wwwroot by default. When I access HTTPS from internal, everything works and If I access the site via HTTP no matter if internal or external, everything works.

Is there a way to see what the server does? Can I log something or trace something? The Logs I see right now don't give me any information to why it does not work.


It's so strange. when I open the site via HTTPS from external it opens this: https://mysite.mydomain.com/iis-85.png when I want to open this exact URL from internal network i get an 404 - File or Folder not found error. the only Folder on the whole IIS which contains this iis-85.png is this one: C:\Windows\WinSxS\amd64_microsoft-windows-iis-startserver_31bf3856ad364e35_6.3.9600.16384_none_bf87a3597b95c1cd and I don't think it could possibly read the data from there.

why is this? Could it be that this is still cached? I did everything to renew the cache, deleted temporpy asp-files, flushed the dns, restartet every site, the IIS itself, every apppool. What else could I do?

Edit: OK I got it. HTTPS was redirected to another server via Firewall NAT.

  • Use sniffer and packet capture software. Start from your source (external network host) and then check at each point you control between there and your IIS server. I suspect DNS or NAT is sending your external requests to the wrong site or server. – Xalorous Sep 29 '16 at 13:38

To me, this sounds like the external requests never actually hit your server, they seem to end up on a different server which would explain why the see a page that is not available on your server.

There are several ways of packet sniffing to find this out on the network level, but as we are talking about IIS here, you can enable http.sys tracing which allows you to trace the component underlying IIS responsible for handling incoming requests.

Taken from my own blog post:

To start the trace, run: logman.exe start httptrace -p Microsoft-Windows-HttpService 0xFFF -o httptrace.etl -ets Perform some requests you want to investigate, then stop the trace: logman.exe stop httptrace -ets convert into a csv file: tracerpt httptrace.etl -of csv -o httptrace.csv /y or maybe better into a event log file which you can open in Event Viewer: tracerpt httptrace.etl -of evtx -o httptrace.evtx /y

| improve this answer | |
  • Hi Peter, thanks for this. I ran this but I need some time to read the evtx. I took a quick look at it but i didn't really saw anything unusual. I will read every message in detail over the weekend and will come back to you after i analyzed it. – SimonS Sep 30 '16 at 8:47
  • Hi Peter. So i just took a look at these traces and I don't know what their meaning is. How can I read and understand this? – SimonS Oct 3 '16 at 7:52
  • In your case all you need to do is open the csv file and see whether any of the requests you just made are in the log. If there are in there, you should see the Side ID and the AppPool name before the url. At least this way you can confirm that your request actually reached your server. – Peter Hahndorf Oct 3 '16 at 8:02
  • Ok, yes, the request hit my server. it's like this (you know german i guess):Anforderungs-ID 17509995361953906899, Site-ID 15) aus der Anforderungswarteschlange "AppPool" für den URI "http://xxx.xxx.xx:80/Api/Crm/GetContactFullName" mit dem Status "0" übermittelt. i edited the URLNAme and APPOOLname. the url has a http prefix and not https. why is that? – SimonS Oct 3 '16 at 8:49

You can generally see what happens in IIS requests using Tracing. For IIS 8.5, you can find instructions here:

Request tracing in IIS 8.5

What you're describing may be happening due to incorrect bindings. IIS displays website content based on bindings. If the domain name you're using externally is different from the internal one, then it must be listed in the bindings tab. Bindings are described here:

Add a Binding to a Site

(article is for IIS 7 but 8 isn't much different). So, to summarize, if your internal domain is "contoso.local" and external domains are "contoso.com" and "contoso-company.com," you'll need 3 entries/bindings. For IIS websites that share a common port, the Host name in bindings can determine which site responds to a request.

Hope this helps!

| improve this answer | |
  • Hi panos, unfortunately not, because IIS doesn't see this as a Failed request, it doesn't log anything. also, the bindings are correct, it's all the same domain. – SimonS Sep 30 '16 at 6:45
  • @SimonS, Despite the name Failed Request Tracing is not only for failed requests, you can specify an http status of 200 and look at details for all requests. But I agree in your case this is still not helpful because I think the requests don't get this far. – Peter Hahndorf Sep 30 '16 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.