Friday, February 12, 2021

HTTP to HTTPS redirection on Windows Server and IIS

Certbot can automatically add http to https redirection when used with Apache on Linux, by appending
RewriteEngine on
RewriteCond %{SERVER_NAME} =whatever.tld
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>


To do the same on Windows, I followed the method given at
https://www.ssl.com/how-to/redirect-http-to-https-with-windows-iis-10/
for redirecting http to https on IIS+Windows. 


  • Download and install the URL Rewrite module
  • In IIS Manager, choose the relevant website, double-click URL Rewrite
  • Click Add Rules on RHS, create a Blank Rule in inbound section.
  • Choose Requested URL: Matches Pattern and Using: Regular Expression, with the Pattern: (.*) and Ignore Case ticked. 
  • Logical Grouping: Match All, then Add...
  • In the Add Condition box, Condition Input: {HTTPS}, Check if input string: Matches the Pattern, Pattern: ^OFF$, Ignore case: ticked.
  • In the Action setting, Edit Inbound Rule, set Action type: Redirect, Rewrite URL: https://{HTTP_HOST}/{REQUEST_URI} ,  Append query string: uncheck, Redirect type:  Permanent (301).
  • Finally, click Apply in the Actions section on Right-hand side.
This would create a web.config in the site's home directory, with contents like:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="HTTPS Redirect" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="^OFF$" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

No comments:

Post a Comment