Mixed content issue in using Application Load Balancer (ALB) in AWS

Question

I have an ASP.Net web application hosted on IIS. The web application (an Umbraco site) is configured to have an HTTP binding in IIS and an SSL certificate is bound to an Application Load Balancer (ALB) in AWS which is used to manage user requests via HTTPS. This means that when a user requests a resource the ALB redirects any HTTP traffic to HTTPS and then forwards the requests to IIS via the port 80 (internal traffic within the VPC).

For most resources this is absolutely fine but there are a handfull of resources (fonts and images) which seem to be requested over HTTP which causes a mixed content warning in the browser. I have tried HTTP -> HTTPS rewrite rules in IIS and outbound rules to rewrite the response but this does not seem to resolve the issue.

Can anyone help?

Answer 1

The solution to the problem was this to run the the web-app locally as HTTPS rather than HTTP and update the load balancer to forward requests to the web-server on port 443 rather than port 80.

To do so

• Create a development SSL certificate on IIS. Rather than creating a self-signed certificate I used this project ( https://github.com/FiloSottile/mkcert ) to do so that the certificate was tusted
• In AWS update the target group that the ALB listener used to forward requests to the IIS server on port 443 rather than port 80.