Automatic IIS redirect http to https on Windows Server 2016

Im Durchschnitt wird dieses Tutorial Automatic IIS redirect http to https on Windows Server 2016 mit 5 bewertet, wobei 1.0 die schlechteste und 5.0 die beste Bewertung ist. Es haben insgesamt 2915 Besucher eine Bewertung abgegeben.
2914 1

Automatic IIS redirect http to https on Windows Server 2016

HTTPS IIS Windows
Automatic IIS redirect http to https on Windows Server 2016

Because IT-Security IS important

IT security is a big issue today. In order to ensure a good feeling for website visitors, it is recommended to encrypt your websites. Especially when the customer data (user name, password, personal data …) are entered on the website, encryption is compulsory to meet the data protection requirements. This article explains how all IIS requests can be encrypted.

Step-by-step instructions for the IIS redirect http to https

Prerequisites

It is assumed that a server has already been set up with Microsoft Windows Server 2016 and the current IIS 10, so that the web page in question can be accessed on both http and https.

If this does not already exist, the following articles will help:

How to install IIS 10 on Windows Server 2016 (German only)
How to get a free SSL-certificate from Let’s Encrypt for IIS Websites (German only)

In addition, the server should not be directly accessed via a LoadBalancer with SSL offloading. If a LoadBalancer with SSL offloading, such as the free LBaas of gridscale is used, this article helps.

Preparing your server

Before we can start configuring you server, another tool needs to be installed: URL Rewrite. It is an official extension to IIS and has been installed together with Server Manager up to version 9. From version 10 onwards, URL rewrite must be installed manually. Microsoft’s free EXE should be downloaded, which can be found here: LINK

Building a server configuration

After the installation, the web page’s root directory has to be accessed. The IIS Manager should not be open during this time. The web.config file is required. If it does not exist yet, it needs to be created again.
Once created, open it with a text editor to insert the following text:

<?xml version="1.0" encoding="UTF-8"?>
	<configuration>
		<system.webServer>
			<rewrite>
				<rules>
					<rule name="Redirect to HTTPS" enabled="false" stopProcessing="true">
						<match url="(.*)" />
						<conditions><add input="{HTTPS}" pattern="^OFF$" />
						</conditions>
						<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />
					</rule>
				</rules>
			</rewrite>
		</system.webServer>
	</configuration>

Now the document can be saved and we can open the IIS. Here you have to navigate to the website in question and open URL rewrite. The rule, which has just been created, should appear. This looks (approximately) like the following:

Rule in IIS

However, the rule is still deactivated. To activate it, find the menu item Enable Rule and click on it.

Activate Rule in IIS

Finished! Http requests are now forwarded automatically to https. Best practice is to test it immediately by opening the website in any browser.

Summary

With little effort, the entire websites traffic is encrypted. Other services, such as WebDAV, can be encrypted with the same certificate too. Have a look at this tutorial to see how it is done: Encrypt WebDAV with Let’s Encrypt (German only).

Because IT-Security IS important IT security is a big issue today. In order to ensure a good feeling for website visitors, it is recommended to encrypt your websites. Especially when the customer data (user name, password, personal data …) are entered on the website, encryption is compulsory to meet the data protection requirements. This article […]

Schade, dass dir der Artikel nicht gefallen hat.
Was sollten wir deiner Meinung nach besser machen?

Thank you for your feedback!
We will get back to you as soon as the article is finished.

Übrigens: kennst du schon unser Tutorial zum Thema Download the free SSL certificate from Let's Encrypt to Microsoft IIS?

×

Developer?

Get the latest gridscale developer tutorials here.
And don’t worry - we won’t spam you