Forcing HTTPS in IIS 6.0

We don’t seem to do much with IIS now which I am very thankful for but every now and again I have to dive back into that scary world. Today I had to force a site to use HTTPS instead of HTTP, a task that is nice and easy in Apache but seems to be something of a complex issue for IIS.

The first thing needed to redirect HTTP to HTTPS is a script that will redirect your pages to the secure channel. I found a script written by Dagar in Michael Coates’s blog post on this subject which worked well for me, thanks Dagar:

<SCRIPT type=text/javascript>
<!--
if (location.protocol != 'https:')
{
window.location = 'https://'+ location.host + location.pathname + location.search;
//alert(location.host + location.pathname + location.search); Just for sanity check}
// -->
</SCRIPT>

Save this as something like ssl_redirect.html on your webserver. I wanted to use this script for more than one site and for the redirect to work correctly it needs to be available in a relative path to each site, so, add the directory the script is located in to your site as a virtual directory:

1. Right click on the site root and choose New>Virtual Directory…
2. Follow the wizard and create an alias of ssl_redirect
3. Choose the path to the directory where the redirect script is located

Set the root of the site to require HTTPS:

1. Right click on the site root again and choose Properties
2. Click the Directory Security tab
3. In the Secure Communications select Edit
4. Turn on Require secure channel (SSL)

This now makes your site only available on HTTPS and will return a 403.4 (Forbidden – SSL required) if you try and connect to it using HTTP. To fix this we need to point this error to our redirect script, back in site root properties:

1. Click the Custom Errors tab
2. Look down the list of error messages and select the 403;4 error
3. Click Edit
4. Change the Message Type to URL
5. Enter the relative path to the redirect script, for me it was /ssl_redirect/ssl_redirect.html
6. Click OK and close the properties dialog box

The last thing to do is to remove the inherited Require secure channel property from the redirect script:

1. Navigate to the redirect script in IIS
2. Right click and choose Properties
3. Click the File Security tab
4. In the Secure Communications select Edit
5. Turn off Require secure channel (SSL)

This allows the script to be run with HTTP. Now when a page is accessed using HTTP the script will run and redirect the page using HTTPS.