ansaurus

Question

Moving ASP.NET website from http to https?

Answer 1

+3 A:

It depends on how you handle the linking of external assets inside your application.

If you use relative paths to reference internal assets and don't link to any files/scripts hosted on other servers, then you should be fine.

If you use full paths to reference assets, for example:

<img src="http://foo.bar.my.site/image.png" />

Or reference external assets:

<script src="http://code.jquery.com/jquery-1.4.2.min.js"&gt;&lt;/script&gt;

Then you are going to get errors in most browsers about mixing secure and non-secure content.

Justin Niessner 2010-06-24 14:19:22

Exactly right, its the same as switching domains if you use relative paths, your in the clear, any absolute paths will need to be updated. -- Another point, is that the default buttons on the dialog that is shown when you are mixing secure and non-secure content, are setup to disallow showing the content, since some data may not be secure. The user can click yes to show the content, but default behavior IIRC is to not show the content.

Nate Bross 2010-06-24 14:22:35

Thanks, as you said I am completely using relative path and i am referring or point external services. My point Do I need to change web.config / configuration to make application available to https?

nRk 2010-06-24 14:29:15

@nRk - No, just adding the cert and configuring IIS should be good.

Justin Niessner 2010-06-24 14:32:37

Thanks.. Justins...

nRk 2010-06-24 14:34:55

I know you state you are using relative paths but we thought we were and then IE found one obscure reference and starting throwing up all sorts of warnings which we could tell was putting off a small percentage of our users. Therefore for what it is worth I would thoroughly test IE7 and probably IE8 as well.

ArtificialGold 2010-06-25 09:50:16

Answer 2

A:

A walk through of setting up SSL on IIS 7 is available at http://learn.iis.net/page.aspx/144/how-to-set-up-ssl-on-iis-7/

As mentioned in another answer, your site itself must contain relative paths or you will get mixed content warnings. It may be enough to simply do a search and replace of HTTP: with HTTPS: throughout your source files.

Larry Smithmier 2010-06-24 14:33:21

Answer 3

A:

Justin is right on the the money with problems arriving from non relative paths and from using mixed script sources. The best thing that you can do is set up a stagging server and test your application on it using https. You can enable Https without getting a certificate for your stagging server though you will get a nice message about the stagging servers certificate from your browser thought everything else should work the same and allow you to plan for the migration

runxc1 Bret Ferrier 2010-06-24 14:37:28

ansaurus

tags:

views:

answers:

Moving ASP.NET website from http to https?

related questions