Re: Port 80 still works after "Require secure channel (SSL)"

"Require Secure Channel (SSL)" applies at a per-URL basis.

Port 80 functioning applies at a per-ServerBinding basis.

The two are not equivalent unless you mark the root of the website as
"Require Secure Channel" and it inherits throughout the website -- so the
fact that both HTTP and HTTPS work with "Require Secure Channel" depends
totally on your configuration, which you did not provide.

Please provide:
1. Exact URL that works for both HTTP and HTTPS
2. The value of the AccessSSLFlags property that applies to that URL

I suspect you have some non-obvious misconfiguration, perhaps via an
IIsWebFile, by accident.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//

"Shifarad" <Shifarad@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:ECD2A25E-3383-4AD2-A769-0E7BDAE43D5D@xxxxxxxxxxxxxxxx
Hi all,
After i locked down a Win2003 Server I installed a certificate, checked
the
"Require secure channel (SSL)" , but i can still logon to this web
application over http. https is working also fine.

Any Ideas?

Thanks,
Shif



.

Relevant Pages

  • Re: OWA - Automatic redirect to HTTPS
    ... I'm using SSL ... and I checked the 'Require secure channel' check box, ... >merely prohibit people from going to http. ... >> I would like to create an automatic redirect from HTTP ...
    (microsoft.public.exchange.admin)
  • Re: ISA 2004 Server Errors
    ... Tunneling SSL Through a WWW Proxy ... CONNECT is really a lower-level function than the rest of the HTTP methods, ... Through ISA Server ...
    (microsoft.public.isa)
  • Re: RWW with no https
    ... What you cannot normally do is configure an HTTP SSL listeners to redirect traffic based on HTTP headers. ... Or dump Kerio Mail Server since you have the same capabilities in Exchange;-) ... > port but going to port 8080. ...
    (microsoft.public.windows.server.sbs)
  • Re: SSL cert in ISA 2006
    ... protocol (HTTP, SMRP, POP3, IMAP, etc.) to provide session-level encryption. ... What is the purpose of SSL used in ISA for? ...
    (microsoft.public.isa.configuration)
  • Finding nonsecure items in secure page
    ... I am modifying an existing ASP.NET application to make it SSL ... Do you want to display the nonsecure items? ... IS there something other than a reference through an explicit "http:" ... Hasn't someone built a plugin for IIS that would allow for monitoring ...
    (microsoft.public.dotnet.framework.aspnet)