Unable to change HNSC HTTP to HTTPS

Question

I have a web application using host named site collections. I set it up using HTTP, later on I figured to use HTTP. I changed the AAM to use HTTPS as default and HTTP as Intranet Zone. Everything is working fine so far - I can access the sites using HTTPS as well as HTTP.

Unfortunately some standard web parts take the URL of the default Zone of the sites. Here comes the problem:

>> Get-SPSiteURL http://collaboration.domain.de

Url                                                                        Zone
---                                                                        ----
http://collaboration.domain.de/                                         Default
https://collaboration.domain.de/                                       Extranet

So the default is HTTP. I cannot change the default zone URL using Set-SPSiteUrl and have to use SPSite.Rename. No problem:

>> Remove-SPSiteUrl https://collaboration.domain.de
>> $site = get-spsite http://collaboration.domain.de
>> $site.Rename("https://collaboration.domain.de")
>> Set-SPSiteUrl -Identity https://collaboration.domain.de -Url http://collaboration.domain.de -Zone Intranet

Again, no errors. And checking the URLs again I get this:

>> Get-SPSiteUrl https://collaboration.domain.de

Url                                                                        Zone
---                                                                        ----
http://collaboration.domain.de/                                           Intranet
https://collaboration.domain.de/                                          Default

Perfect! (mind the order it's the other way around?) But here comes the problem. I cannot access the site anymore using HTTPS, I get access denied errors as well as these System.ArgumentException with encodedValuein the ULS log, see the relevant excerpt of the log here: http://pastebin.com/8QrtakKz. I'm using Windows Authentication (NTLM), not forms.

I can change the URL back with no problem using the same process as described above and everything starts working again, only with the wrong URL in the default zone.

---

1. What am I doing wrong?
2. How can I change a HNSC (host named site collection) default zone URL from HTTP to HTTPS?
3. How can I change all site collections beneath the HNSC including a managed path (in this case it is /community/communitysite1, /community/communitysite2, ...) to have a default zone URL with HTTPS?

If all else fails, how can I backup the sites and restore them at a new location, but again with HNSC? I would like to use the suggested way of using .Rename().

Disclaimer: I also posted to MSDN Forums and will update with a solution if its found there.

Answer 1

Apparently it is not possible to switch to HTTPS after setting up the root HNSC web application without SSL (-SecureSocketsLayer parameter) - see "SPSite.Rename not working from HTTP to HTTPS (HNSC)".

The solution: You will have to delete the existing HSNC web application (make sure to not delete the content databases[!!!]) and recreate it with the -SecureSocketsLayer parameter in PowerShell. Afterwards you can change all the contained site collections with Move-SPSite and move them to the new https based location. Maybe you will also want to add HTTP back to the sites for which you can use Set-SPSiteURL.