Requiring SSL For Website When Using An SSL Offloader

[JabbaTheNut]

An SSL offloader appliance traps incoming https:// requests on port 443, decrypts them, converts them to http:// requests and then forwards them to the web server on port 80. The web server then provides an http:// response which is again trapped by the SSL offloader appliance, encrypted and converted to https:// and sent to the client.

My problem is this...

I want to allow normal http:// requests to my Default Web Site (no problem here). However, I also want to require SSL requests (

https://)

to an application within my Default Web Site. For example, I want to allow an http:// request for

http://www.mysite.com,

but want to require SSL (

https://)

for a request to

http://www.mysite.com/myapplication.

Without an SSL offloader appliance, I would simply install a certificate on my web server and select the "Require secure connection" option for "myapplication". All http:// requests on port 80 would be rejected and all https:// requests on port 443 would be accepted. All would be fine.

With an SSL offloader appliance, however, all requests are directed to port 80. Consequently, the web server throws an error stating that a secure connection is required.

Can someone provide some suggestions for requiring an SSL connection in IIS when using an SSL offloader appliance? Alternatively, can someone suggest another method for ensuring that the request coming in on port 80 originated from an https:// request?

This is a critical question for me. Any help would be greatly appreciated.


Game Over, Man!

 

[devilman0]

did you get any thing?

Thanks,
James

"Make it idiot-proof and someone will make a better idiot." ~bumper sticker

 

[JabbaTheNut]

I finally solved my problem.

I set up two websites ("Default Web Site" & "Secure Web Site&quot. The "Default Web Site" was set to accept http:// requests on port 80 and the Secure Web Site was set to receive http:// requests on port 8080.

I set the SSL offloader to accept https:// requests on port 443 and to send the converted http:// requests to port 8080. Additionally, I set the SSL offloader to block all incoming requests on port 8080.

The end result is as follows:

--http:// requests on port 80 are allowed to pass through the SSL offloader and are received by "Default Web Site".

--https:// requests on port 443 are trapped by the SSL offloader, converted to http:// requests, and are sent to port 8080. They are then received by "Secure Web Site".

--For the underhanded characters that might try to enter "Secure Web Site" using an http:// request on port 8080 (thus bypassing SSL), the SSL offloader is set to block the incoming request.

Consequently, all requests coming in on port 8080 are known to have originated from a secure request that has been decrypted by the SSL offloader.

The above manipulations could have also been done using a second ip address instead of a second port address.

Game Over, Man!