How asp.net website supports https(ssl)?

Question

I used asp.net to made a website, it's been worked and maintained for 3 years. Now customer required me to support https to make clients' requests and personal information secure in the internet. This is not a huge website but only with user login and online products reservation.

Requirements are:

1. If users not logged in, http without ssl, once user logged in, https enabled.

2. User logged out, return to http.

Currently, we paid for a RapidSSL certificate and waiting for agent's response. I'm not sure how many changes still necessary for the web applications? How asp.net 2.0 support ssl for these requirements.

Answer 1

The First thing you need to install the certificate on the server which will your web application place.

In my case , i will use Security Switch -- > https://code.google.com/p/securityswitch/

You can choose to protect certain folder in your web config, you also can choose which folder you want to ignore.

 <securitySwitch mode="Off" xmlns="http://SecuritySwitch-v4.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="SecuritySwitch-v4.xsd">
<paths>
  <!-- You should only need one of these paths based on where your login/logon page/view is accessed from. -->
  <add path="~/Account/" />
  <add path="~/Application/" />  
  <add path="~/Images/" security="Ignore" />
  <add path="~/Scripts/" security="Ignore" />
</paths>

Answer 2

You may also need to require the user's browser to connect using https as some don't do it automatically. I'm not sure if the tool above does this automatically but you can do this with web.config like this..

<system.webServer>
<rewrite>
        <rules>
            <clear />
            <rule name="Redirect to https" stopProcessing="true">
                <match url="(.*)" />
                <conditions>
                    <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                </conditions>
                <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" />
            </rule>
        </rules>
    </rewrite>
</system.webServer>