So I need to redirect the incoming traffic to my website so that it always uses https/SSL.

I am running IIS 7.5 on my Windows 7 machine.  I googled for “how do I make sure that all my web traffic uses https“.

The second link showing was to my web host, GoDaddy.com.  They have a page that says how to do it.  But what they didn’t tell me was how much effort I would have to go to to get it to work.

First, I had to realize that the URL Rewrite Module was an IIS plug-in and not something that comes “in the box.”  I downloaded and installed the 64-bit version.  Once installed, I could see the URL Rewrite icon in IIS Manager.

Second, I added the code to my web.config file.  Here’s the code:

<configuration>
<system.webServer>
<rewrite>
    <rules>
	<rule name="HTTP to HTTPS redirect" stopProcessing="true"> 
	    <match url="(.*)" /> 
	    <conditions> 
		<add input="{HTTPS}" pattern="off" ignoreCase="true" />
	    </conditions> 
	    <action type="Redirect" redirectType="Permanent" 
                    url="https://{HTTP_HOST}/{R:1}" />
        </rule>   
    </rules>
</rewrite>
</system.webServer>
</configuration>

Four hours later, it works…

Here are the gotchas I ran into:

1. Things get complicated if you try to put the redirect in a subsite.  The Rule code above must be in the web.config file in the root website.  Not a subsite.
   (I never did figure out how you might do that.  In my case, it doesn’t matter because I want my entire domain to be running in HTTPS mode.)
2. You cannot go to the SSL Settings screen in IIS Manager and check the option to require SSL.  That option must remain unchecked to allow the HTTP traffic through so the rule can redirect it.
   
3. Your website must have bindings to both HTTP and HTTPS.
   1. In IIS Manager, select the root website on the left.
   2. Next, select the Bindings option under Edit Site in the Action bar on the right.
   3. Make sure you have bindings for HTTP (typically port 80) and HTTPS (typically port 443).
      
      

      

      
4. You do not want to mess with the HTTP Redirect option in IIS Manager.  That will not solve the original problem. The HTTP Redirect is used to forward all traffic from, say, a parked domain, to another domain entirely.
   
5. Did I mention that the Rule code above only works at the root level of the server?   Make sure it is in the web.config at the root level, not in a virtual directory or subsite below the root.

And that’s all I have to say about that.

Oh, one more thing.  Many thanks to RUSLAN YAKUSHEV  at Microsoft for his excellent documentation and blog articles about the URL Update Module.