Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have recently configured the farm to be accessed via HTTPS.

When clients connect to their content using HTTPS, all is fine.

When connecting to a site collection using HTTP, the client is redirected to the HTTPS, and this also is fine.

However, and this is the reason why I'm writing this question, when the client connects to a subsite using HTTP, the server does not redirect to HTTPS, and the client is allowed to browse content entirely via HTTP.

I think this is due to a misconfiguration in the system which someone more expert than me may explain and answer with a solution.

I'd like the system still performing HTTP redirection to HTTPS even when clients connect directly to subsites or pages.

Here follows the details of my configuration:

In SharePoint, web application list, I've SharePoint -80 with HTTPS url https://sps.mycompany.net. This web application originally had HTTP url http://sps.mycompany.net and was extended with the HTTPS.

In SharePoint the AAM is configured as follows:

Internal URL               Zone    Public URL for Zone 
http://sps                 Default https://sps.mycompany.net 
https://sps.mycompany.net  Default https://sps.mycompany.net 
http://sps.mycompany.net   Default https://sps.mycompany.net 

In IIS, I have the following web sites, SharePoint - 80 and the SharePoint - 443 both running. The server certificate has been assigned only to SharePoint - 443.

Please tell me if you need more detail.

share|improve this question

1 Answer 1

You can disable the http binding in your IIS. Open the site and have a look on the right side under "Actions" you will find "Bindings". Allow only the 443 binding with a valid certificate for your site and remove the 80 port binding ;) If you do this then users will not be able to reach anything with http anymore for this site.

You can use the Rewrite module in IIS for directing them to https automatically:

When a site that requires SSL is accessed via non-secure HTTP connection, IIS responds with HTTP 403 (Unauthorized) status code. This may be fine if you always expect that your site visitors will be typing “https://…” in the browser’s address bar. But if you want your site to be easily discoverable and more user friendly, you probably would not want to return 403 response to visitors who came over unsecure HTTP connection. Instead you would want to redirect them to the secure equivalent of the URL they have requested. A typical example is this URL: http://www.paypal.com. If you follow it you will see that browser gets redirected to https://www.paypal.com.

With URL Rewrite Module you can perform this kind of redirection by using the following rule:

<rule name="Redirect to HTTPS" stopProcessing="true">
  <match url="(.*)" />
  <conditions>
    <add input="{HTTPS}" pattern="^OFF$" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther" />
</rule>
share|improve this answer
    
Thanks for your clear answer. Can you describe a bit of the rule? What are the risks of the this approach, if any. –  empo Mar 30 '13 at 8:54
    
In my opinion there is no risk. Users that stored a http link will be forwarded automatically. –  hupseb Mar 30 '13 at 13:10
    
Try it on a test system if you have doubts. –  hupseb Mar 30 '13 at 13:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.