SSL redirect/rewriting

user_16768989 0
Viewed 60

I have an issue that cannot seem to find an answer for so hoping someone can assist.

I have a dynamic website that has 300+ unique domains pointing to it.

Recently needing the secure this with an SSL I need to use a UCC/SAN certificate. I only want to put the www version of each domain on the certificate to save money and space on the certificate (seems Safari only allows for 318 entries per cert).

Question I have is how do you redirect traffic to www. so it matches the certificate if the requested URL begins with https.

Example: I am using http to https and adding www prefix using URL Rewrite for IIS

"http://www.example.com" goes to "https://www.example.com"
"http://example.com" goes to "https://www.example.com"
"https://example.com" fails because of certificate name mismatch

I apologize for my ignorance but it seems like the browser verifies the certificate before allowing the redirect to happen? Is there a method I am unaware of?

Any help would be greatly appreciated!!

asp.net-core ssl asp.net-mvc asp.net
2 Answers

As you note, you can do most of this with the IIS URL Rewrite module.

The following rule can be added to your web.config

<system.webServer>
  <rewrite>
    <rules>
       <rule name="RedirectToSecure" stopProcessing="true">
          <match url="(.*)" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
            <add input="{HTTPS}" pattern="off" />
            <add input="{HTTP_HOST}" pattern="^www\..*$" negate="true"/>
         <conditions >
          <action type="Redirect" url="https://www.{HTTP_HOST}/{R:1}" redirectType="Permanent" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

This rule has a match that captures everything on the path of the URL, it then has two conditions, the first checks that the request wasn't on HTTPS, the second checks to see if the host includes www., both of these have match to trigger the rule, finally the action will permanently redirect the user to the secure, www version of the requested URL.

You could then have another copy of this rule with just the first condition to redirect the non-SSL version of the www domains to HTTPS (just remove the www. part from the action as well).

However you are slight hampered by not including certificates for the non-www versions. Browsers do indeed confirm that the certificates sent by the server for a request match the requested host, and will throw warnings and errors up to the user if they don't. Without a certificate that covers the non-www versions there's not really any way around this.

Obviously SAN certificates are probably a cheaper option than 300+ wildcards, however another option to consider, depending on your hosting solution, would be automating Let's Encrypt certificates instead - this would allow you to generate and install certificates for the root and www subdomain as required. This would have to be automated however as these certificates expire after 3 months, and generating them for 300+ domains would be very labour intensive.

user_330510

You can use a reverse proxy to achieve this.

From the IIS home page, select or double click the site. On the right sidebar called Actions, click Bindings. Add a binding for https. Set the hostname to example.com. You'll have to select an SSL certificate for it. Also specify a physical path. Let the path be a new folder on your path, lets call f1.

enter image description here

After that, the next step to is to redirect traffic going to http://example.com to instead go to http://www.example.com. You'll use the URL Rewrite module to do so.

From the website's homepage select URL Rewrite. The URL Rewrite page shows up. From the right sidebar select Add Rule, then select Reverse Proxy. Specify the Inbound rule as: https://www.example.com. Uncheck Enable SSL Offloading.

enter image description here

Click OK, you'll be taken back to the rules. Double click the newly created inbound rule. The Edit Inbound Rule page shows up. In the section of Conditions, remove the {CACHE_URL} entry from the list. Go down to the Rewrite URL edit box and modify the value to be: https://www.example.com/{R:1}

enter image description here

From the right sidebar click Apply. That should be enough to configure the URL rewrite.

Now from the left sidebar click Application Pools, select the relevant pool and change its Identity to LocalSystem.

Go to the folder you created, in this case f1. Under its properties, add a user called IUSR. The user is located on the local computer so if the computer name is JUNIT select JUNIT as the location.

You can now test the configuration. Let me know how it goes.

user_100306930
Related