Im Durchschnitt wird dieses Tutorial Automatic IIS redirect http to https on Windows Server 2016 mit 5 bewertet, wobei 1.0 die schlechteste und 5.0 die beste Bewertung ist. Es haben insgesamt 365 Besucher eine Bewertung abgegeben.
364 1

Automatic IIS redirect http to https on Windows Server 2016

from gridscale Team HTTPS IIS Windows
Automatic IIS redirect http to https on Windows Server 2016

Because IT-Security IS important

IT security is a big issue today. In order to ensure a good feeling for website visitors, it is recommended to encrypt your websites. Especially when the customer data (user name, password, personal data …) are entered on the website, encryption is compulsory to meet the data protection requirements. This article explains how all IIS requests can be encrypted.

Step-by-step instructions for the IIS redirect http to https

Prerequisites

It is assumed that a server has already been set up with Microsoft Windows Server 2016 and the current IIS 10, so that the web page in question can be accessed on both http and https.

If this does not already exist, the following articles will help:

How to install IIS 10 on Windows Server 2016 (German only)
How to get a free SSL-certificate from Let’s Encrypt for IIS Websites (German only)

In addition, the server should not be directly accessed via a LoadBalancer with SSL offloading. If a LoadBalancer with SSL offloading, such as the free LBaas of gridscale, is used, this article helps.

Preparing your server

Before the configuration is able to start, another tool needs to be installed: URL Rewrite. It is an official extension to IIS and has been installed together with Server Manager up to version 9. From version 10 onwards, URL rewrite must be installed manually. Microsoft’s free EXE should be downloaded, which can be found here: LINK

Building a server configuration

After the installation, the web page’s root directory has to be accessed. The IIS Manager should not be open during this time. The web.config file is required. If it does not exist yet, it needs to be created again.
After that it has to be opened with a text editor to insert the following text:

<?xml version="1.0" encoding="UTF-8"?>
	<configuration>
		<system.webServer>
			<rewrite>
				<rules>
					<rule name="Redirect to HTTPS" enabled="false" stopProcessing="true">
						<match url="(.*)" />
						<conditions><add input="{HTTPS}" pattern="^OFF$" />
						</conditions>
						<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />
					</rule>
				</rules>
			</rewrite>
		</system.webServer>
	</configuration>

Now the document can be saved and the IIS is able to be opened. Here you have to navigate to the website in question and open URL rewrite. The rule, which has just been created, should appear. This looks (approximately) like the following:

Rule in IIS

However, the rule is still deactivated. For activation, find the menu item Enable Rule and click on it.

Activate Rule in IIS

Finished! Http requests are now forwarded automatically to https. Best practice is to test it immediately by opening the website in any browser.

Summary

With little effort, the entire website traffic is encrypted. Other services, such as WebDAV, can be encrypted with the same certificate, too. Have a look at this tutorial to see how it is done: Encrypt WebDAV with Let’s Encrypt (German only).

Because IT-Security IS important IT security is a big issue today. In order to ensure a good feeling for website visitors, it is recommended to encrypt your websites. Especially when the customer data (user name, password, personal data …) are entered on the website, encryption is compulsory to meet the data protection requirements. This article […]

Schade, dass dir der Artikel nicht gefallen hat.
Was sollten wir deiner Meinung nach besser machen?

×

Developer?

Get the latest gridscale developer tutorials here.
And don’t worry - we won’t spam you