How To: Redirect HTTP to HTTPS

Version Affected: All

 

Overview

This article explains how to configure a realm so that HTTP requests are automatically redirected to HTTPS, instead of the connection being denied. If a user connects to a realm secured with SSL over HTTP (port 80), IIS returns: "HTTP Error 403.4 - Forbidden. The page you are trying to access is secured with Secure Sockets Layer (SSL)."

• Use Method 1 to configure the redirect using the IIS URL Rewrite module.
• Use Method 2 to configure the redirect by editing web.config directly.
   

In this article

• Method 1: Using the IIS URL Rewrite Module
• Method 2: Editing web.config Directly

Method 1: Using the IIS URL Rewrite Module

If the URL Rewrite module is not installed, download it from the IIS.net URL Rewrite page.

1. In IIS Manager, expand Sites, then select Default Web Site. Double-click URL Rewrite to open it.
2. In the Actions pane, click Add Rule(s).
   
3. Under Inbound rules, select Blank rule.
   
4. Configure the rule: set Name to HTTP to HTTPS Redirect; under Match URL, set Requested URL to Matches the Pattern, Using to Wildcards, and Pattern to * (with Ignore case checked); under Conditions, set Logical grouping to Match Any, and add a condition: Input {HTTPS}, Type Matches the Pattern, Pattern off.
   
5. Under Action, set Action type to Redirect, Redirect URL to https://{HTTP_HOST}/{R:1}, check Append query string, and set Redirect type to Found (302). Click Apply.
   
6. For any realm that should use this rule, turn off Require SSL: open the realm, click SSL Settings, and clear the Require SSL checkbox.
   

Method 2: Editing web.config Directly

1. Locate the IIS root folder — usually %systemdrive%\inetpub\wwwroot, though the instance may be on a different drive depending on the setup.
2. Open web.config in that folder and add the following rule:
   

   <rule name="HTTP to HTTPS redirect" stopProcessing="true">
     <match url="(.*)" />
     <conditions>
       <add input="{HTTPS}" pattern="off" ignoreCase="true" />
     </conditions>
     <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
   </rule>

3. Save the file.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.