Certificate

A certificate, signed by a certificate authority needs to be created and installed on the web server. How this is done differs if the server is accessible from the public internet or not.

Public Facing Web Server

If the web server is public facing then a free certificate can be obtained using Let's Encrypt. follow the instructions in SSL/TLS using Let's Encrypt

Alternatively you can use any commercial certificate authority. Ex: DigiCert, Entrust, Thawte, etc.

Internal Web Server

If the server is internal then an internal Certificate Authority will be needed.

1. Identify the Certificate Authority (CA) - If you need to setup Microsoft Certificate Services the following links may help:
• If you don't have Active Directory - http://www.isaserver.org/img/upl/vpnkitbeta2/installstandaloneca.htm
• If you have Active Directory - http://www.isaserver.org/img/upl/vpnkitbeta2/installenterpriseca.htm
  
  
2. Install the Certificate - Request and install a certificate for the website under which the application will run. See: How to Get a Certificate from an internal CA
• The certificate must be created for a website (ex: Default Web Site) not the virtual directory for the web application.
• A Bit length of 2048 is recommended.
• The website (ex: Default Web Site) does not have to be set to require SSL. That can be set on the virtual directory for the web application.
• See this Microsoft KB article for more information: http://support.microsoft.com/kb/299875

IIS Configuration

Binding

Skip this if Certify SSL Manager was used as it will already be done.

Add an https site binding

1. Select the Website that contains the web application (ex: Sites/Default Web Site)
2. In the Actions pane, click Bindings... 
3. In the Site Bindings dialog click Add...
4. Add https Binding
1. Type: https:
2. IP Address: All Unassigned
3. Port: 443
4. SSL certificate: Select the certification you installed
5. Click OK
5. Click Close

Service Endpoints

Make it so that web services can or must use HTTPS.

...

1. Open web.config
2. Find <services>
3. For each endpoint within each <service> do one of:
1. For HTTPS access only: Edit “Http” in binding value to “Https”.
   
   Ex: “basicHttpBinding” ➔ “basicHttpsBinding”; “mexHttpBinding” ➔ “mexHttpsBinding”
   
   
2. For HTTP and HTTPS access: Add a copy all endpoints with “Http” in binding value and edit value to have Https.
   
   Ex: Copy endpoint line and edit “basicHttpBinding” ➔ “basicHttpsBinding” – Use this if both HTTP and HTTPS will be used.

URL Rewrite

Redirect HTTP to HTTPS.

1. Install the URL Rewrite Module for IIS: http://www.iis.net/downloads/microsoft/url-rewrite
2. Require SSL should not be checked for either Default Web Site or for the application (ex: AdamsAdmin, AdamsWeb, AdamsBridge, etc) under that.  You can check the SSL Settings for each to see that it isn’t.
3. Create the URL rewrite rules for each web application (i.e. Adams Web, Adams Admin, Adams Bridge) 
1. In IIS Manager, select the application (ex: AdamsWeb, AdamsAdmin, AdamsBridge) under Default Web Site
2. In the application’s IIS section, open the URL Rewrite module
   
   NOTE: If the URL Rewrite module does not appear as an option after installing it, try closing and reopening IIS Manager.
   
   
3. Click Add Rule(s)…
4. Select Inbound rules > Blank rule
5. Select OK
6. Fill in the following information
   1. Name: HTTP to HTTPS Redirect
   2. Match URL
      1. Requested URL: Matches the Pattern
      2. Using: Regular Expressions
      3. Pattern: (.*)
      4. Ignore case: checked
   3. Conditions
      1. Logical grouping: Match All
      2. Click Add…
         1. Condition input: {HTTPS}
         2. Check if input string: Matches the Pattern
         3. Pattern: ^OFF$
         4. Ignore case: checked
         5. Click OK
      3. Click Add…
         1. Condition input: {PATH_INFO}
         2. Check if input string: Matches the Pattern
         3. Pattern: <APPNAME>.* 
            
            Replace <APPNAME> in this pattern with the web applications name. Ex:
            AdamsWeb.*
            AdamsBridge.*
            AdamsAdmin.*
            
            
         4. Ignore case: checked
         5. Click OK
      4. Action
      5. Action type: Redirect
      6. Redirect URL: https://{HTTP_HOST}/<APPNAME>/
         
         Replace <APPNAME> with the web application name. Ex:
         https://{HTTP_HOST}/AdamsWeb/
         https://{HTTP_HOST}/AdamsBridge/
         https://{HTTP_HOST}/AdamsAdmin/
         
         
      7. Append query string: checked
      8. Redirect type: Permanent (301)
7. Click Apply (in the upper hand corner)
8. Click Back to Rules
9. Restart the web application pool

...