Hosting and Servers

21-Oct-13 7:13

I am trying to force a canonical domain rewrite for HTTPS in IIS using the rewrite module - i.e
if user types
https://mydomain.com?querystring
they get sent to
https://www.mydomain.com?querystring

I can get this to work for the simple HTTP protocol, but not HTTPS - I've tried all sorts of variations but this is the closest (as I say, it works for HTTP)

XML

<rewrite>
    <rules>
        <rule name="force_www_https" enabled="true" patternSyntax="ECMAScript" stopProcessing="true">
            <match url=".*" />
            <conditions>
                <add input="{HTTPS_HOST}" pattern="^mydomain.com$" />
            </conditions>
            <action type="Redirect" url="https://www.mydomain.com/{R:0}" redirectType="Permanent" />
        </rule>
        <rule name="force_www" enabled="true" patternSyntax="ECMAScript" stopProcessing="true">
            <match url=".*" />
            <conditions>
                <add input="{HTTP_HOST}" pattern="^mydomain.com$" />
            </conditions>
            <action type="Redirect" url="http://www.mydomain.com/{R:0}" redirectType="Permanent" />
        </rule>
    </rules>

so why won't my HTTPS URL's redirect?

The issue is my SSL certificate which is only valid for www.mydomain.com, so if users type in teh URL for a secure page without the www. they get presented with a browser securoty warning.

Any help gratefully received!

Richard Deeming21-Oct-13 7:38

21-Oct-13 7:38

Try something like this:

XML

<rewrite>
    <rules>
        <rule name="force_www_https" enabled="true" stopProcessing="true">
            <match url=".*" />
 
            <conditions>
                <add input="{HTTPS}" pattern="on" />
                <add input="{HTTP_HOST}" pattern="^www.mydomain.com$" negate="true" />
            </conditions>
 
            <action 
                type="Redirect" 
                redirectType="Permanent" 
                url="https://www.mydomain.com{REQUEST_URI}" 
                appendQueryString="false" 
            />
        </rule>
        
        <rule name="force_www_http" enabled="true" stopProcessing="true">
            <match url=".*" />
            
            <conditions>
                <add input="{HTTPS}" pattern="off" />
                <add input="{HTTP_HOST}" pattern="^www.mydomain.com$" negate="true" />
            </conditions>
 
            <action 
                type="Redirect" 
                redirectType="Permanent" 
                url="http://www.mydomain.com{REQUEST_URI}" 
                appendQueryString="false" 
            />
        </rule>
    </rules>
</rewrite>

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

modified 21-Oct-13 14:06pm.

Wombaticus21-Oct-13 7:50

21-Oct-13 7:50

Thanks, but... still stays stubbornly on https://mydomain.com....

Richard Deeming21-Oct-13 8:07

21-Oct-13 8:07

OK, I think I see the problem. I've updated the rules in my previous answer.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Wombaticus21-Oct-13 8:15

21-Oct-13 8:15

Still no, I'm afraid... as before, it's fine for HTTP but not HTTPS

Richard Deeming21-Oct-13 8:30

21-Oct-13 8:30

Have you copied the rules exactly as I posted them, substituting your real domain name?
NB: Your question used {HTTPS_HOST}, which doesn't exist. You have to use {HTTP_HOST} instead.

Are you sure you're updating the config file on the live server?

Is there any load-balancing hardware in the way?

Everything I've seen suggests that the rules I posted should work. For example, they're practically identical to:
http://www.rewriteguide.com/enforce-canonical-domain-iis.html[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Wombaticus21-Oct-13 8:35

21-Oct-13 8:35

Yes, I copy pasted your code, substitutuing the domain name, to he live server - but see my other post in reply to this...

While the certificate is installed on this server (of course) the domain's DNS is handled by a third-party, adn it *seems* as though what is happening is that when the original request comes in, the DNS server is requesting authorisation from the certificate before passing teh request on.... is that how it works? It would explain it, but leave me in a fix...

[edit] no, no load balancing

Richard Deeming21-Oct-13 8:43

21-Oct-13 8:43

The DNS server shouldn't be requesting anything from your site. It's simply an address book which maps an entry like www.mydomain.com to an IP address.

From your other post, it sounds like the browser is making the request for https://mydomain.com, and then barfing when it gets a certificate for www.mydomain.com, since they might not be the same site.

Many certificate authorities will issue a certificate which is valid for both www.mydomain.com and mydomain.com, so it might be worth seeing if that's an option. Otherwise, you'll need a spare IP address and a second SSL cert to avoid this error. (You could probably get away with a free cert from StartSSL[^], since you're only securing a redirect to the real site.)

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Wombaticus21-Oct-13 8:57

21-Oct-13 8:57

Yes, I was afraid that might be the case. Given that it's pretty much a standard that mydomain.com and www.mydomain.com be the same site, you'd think this would be a standard too for SSL certificates. Sigh.

Thanks anyway for your help.

Wombaticus21-Oct-13 8:31