Redirect from https to http when the SSL cert is no longer valid

1
votes

I have an IIS 6.0 server and I'm no longer using an SSL certificate (Don't need it anymore because of some functional changes, don't have a valid one I can use). Is there a way for me to redirect users to the http site who already have the https one bookmarked?

I tried using a self signed certificate and rewriting the URL to the http version but browsers get a warning about the self signed certificate before I can redirect using web.config.

I also tried removing port 443 as an HTTPS binding and adding port 443 as an HTTP binding but it didn't work. When I tried to start the web site I got an error indicating the port was already in use.

2
iisredirectsslhttpsiis-6
"Redirect from https to http..." - Bad idea. A self-signed certificate providing opportunistic encryption is better than no encryption. Don't let the broken browser security model make you do dumb things. Stick to your guns and use the self signed cert. Or, get a free Class 1 certificate from Startcom. It works for most mobile and desktop browsers. – jww
Bought a new cert to cover this instead just temporarily. Better user experience and it isn't too expensive. – user1529587

2 Answers

3
votes

No, you can't.

Redirections from HTTPS to HTTP happen after the initial HTTPS request has been made, and this request expects a valid certificate to be used. If what you'd like to do was possible, downgrade MITM attacks would be far too easy to perform.

Perhaps turning off port 443 completely might make your users try plain HTTP too, although they really should consider this to be a potential attack if they don't know your site.

2
votes

It is not possible what you want because it first has to do the SSL connect (which causes the warning) before it gets the HTTP redirect. And, this questions is asked nearly daily so you should have find enough answers to it.