14

We want ALL sites on our webserver (IIS 10) to enforce SSL (ie redirect HTTP to HTTPS).

We are currently 'Requiring SSL' on each site and setting up a 403 error handler to perform a 302 redirect to the https address for that specific site.

This works great. But it's a pain to do for every single site, there's plenty of room for human error.

Ideally I'd like to set up a permanent 301 redirect on all HTTP://* to HTTPS://*

Is there a simple way to do this in IIS ?

  • Can't you write a script to make this change for every site which would both reduce the administrative burden and also help prevent typos and mistakes? – Todd Wilcox Jan 23 '18 at 14:03
  • 1
    The title is incorrect. I think it was intended to read "Best way to redirect all HTTP to HTTPS in IIS" – Mick Jan 24 '18 at 5:48
  • @ToddWilcox can you give an example of such a script? – userSteve Jan 24 '18 at 10:02
  • Don't use IIS, :D – ExtraT Oct 17 '18 at 14:43
24
+50

The IIS URL Rewrite Module for IIS7+ may be your friend. The module can be downloaded here: https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-the-url-rewrite-module

Once it's installed, you can create a host wide redirect. After the module is installed, you'll have a URL Rewrite App in IIS manager. Click that and then Add Rule(s)... and select Blank rule.

Match URL
Requested URL: Matches the Pattern
Using: Wildcards
Pattern: * and Ignore case

Conditions
Logical grouping: Match Any
Input: {HTTPS}
Type: Matches the Pattern
Pattern: off

Server Variables
Leave blank.

Action
Action type: Redirect
Redirect URL: https://{HTTP_HOST}{REQUEST_URI}
Append query string: checked Redirect type: Permanent (301)

Apply the rule and run IISReset (or click Restart in the IIS Manager)

Alternatively, after installing the module you could modify web.config as follows:

<rewrite>
    <rules>
        <rule name="Redirect to https" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
            <match url="*" negate="false" />
            <conditions logicalGrouping="MatchAny">
                <add input="{HTTPS}" pattern="off" />
            </conditions>
            <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" />
        </rule>
    </rules>
</rewrite>
  • Will this work for permanent 301 redirects ? – userSteve Jan 24 '18 at 10:03
  • @userSteve as per the answer above, you can choose the redirect type. – BE77Y Jan 24 '18 at 15:38
  • @userSteve whoops, yeah you should be able to change the Redirect Type to 301 and get the same results – sippybear Jan 24 '18 at 18:06
  • 1
    @sippybear one more question - what does input="{HTTPS}" mean? Should this be {HTTP} as that will be the input and HTTP the output? – userSteve Jan 30 '18 at 18:10
  • 3
    {HTTPS} is a variable that you query to find out if the connection is secured. You can read more about it here: docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/… In this case, we're checking whether {HTTPS} is "off", and then redirecting if it is – sippybear Jan 30 '18 at 21:41
0

My research shows that this might be a better way to the redirect:

<rewrite>
    <rules>
        <rule name="http to https" stopProcessing="true">
            <match url="(.*)" />
            <conditions>
                <add input="{HTTPS}" pattern="^OFF$" />
            </conditions>
            <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" />
        </rule>
    </rules>
</rewrite>
  • Can you explain why this is better? – userSteve Jun 12 '18 at 14:49
  • I am sorry I can not explain it my self, just read in few places that is syntax is better. – Fallen Angel Jun 13 '18 at 15:39
  • do you have any sources? – dangel Oct 26 '18 at 1:38
  • This is exactly the same rule as in serverfault.com/a/893804/7184, but written using regular expressions and Match All grouping. One upside could be that the rule expression uses rule defaults and is terser. – bzlm Dec 28 '18 at 23:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.