CODEWITHSUNDEEP
asp.netasp.net-mvcsslhttps
ledgeJumper
ledgeJumper

Reputation: 3630

getting https to work locally in asp.net MVC4 application

I followed this tutorial exactly:

http://www.hanselman.com/blog/WorkingWithSSLAtDevelopmentTimeIsEasierWithIISExpress.aspx

But when I am running locally and try to navigate from a non-https page (like home/index) to and a page I decorated with [RequireHttps] I get the generic "SSL connection error" message.

I hate posting such a generic question, but can you think of anything I have missed? It is a large asp.net mvc4 application, I enabled ssl in the project, it shows the ssl url. Navigating to the ssl url manually does not work either.

HALP!

NOTE: Using IIS Express with visual studio 2012

Per the comment, the error I am getting is Cannot Establish SSL connection.

Upvotes: 2

Views: 6080

Answers (3)

Patrick Stephansen
Patrick Stephansen

Reputation: 798

I know it's already answered, but I thought I'd point out the cause of the original error, which the other answers omit.

When you enable SSL on IIS Express, your site is hosted on 2 ports, 1 for http and another for https. When you debug in Visual Studio, the port is usually specified explicitly. The links on your site probably don't specify port numbers, so when you link from a plain http page to a https one, the port number won't change, and you'll request a https page on the plain http port. This is why you get the SSL connection error.

On a real server the port numbers should be implicit, so the problem shouldn't come up, but you'll need to make sure you're using the right port when debugging locally.

Upvotes: 4

Dima
Dima

Reputation: 6741

You need to add ssl certificate to your site instance in IIS. To create certifiacte and add it to IIS7 try this tutorial: http://technet.microsoft.com/en-us/library/cc753127(v=ws.10).aspx

After creation you'll be able to add it to your website. Open in IIS 'your website' -> Bindings -> Add and add new host header. Select https, port 443 and select created sertificate.

Upvotes: 3

Jack
Jack

Reputation: 2660

You shouldn't be using Https when testing locally. I've created my own Https Filter where it will ignore all the local traffic in the localhost and only works either on staging and live environment. You can modify the code to suit you need.

public class RequireSSLAttribute : FilterAttribute, IAuthorizationFilter {
    public virtual void OnAuthorization(AuthorizationContext filterContext) {
        if(filterContext == null) {
            throw new ArgumentNullException("filterContext");
        }

        if(!filterContext.HttpContext.Request.IsSecureConnection) {
            HandleNonHttpsRequest(filterContext);
        }
    }

    protected virtual void HandleNonHttpsRequest(AuthorizationContext filterContext) {
        if(filterContext.HttpContext.Request.Url.Host.Contains("localhost")) return;


        if(!String.Equals(filterContext.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase)) {
            throw new InvalidOperationException("The requested resource can only be accessed via SSL");
        }

        string url = "https://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
        //ignore if the request is from a child action
        if(!filterContext.IsChildAction) {
            filterContext.Result = new RedirectResult(url);
        }
    }
}

And this is how you use it...

[RequireSSL(Order=1), Authorize(Order=2)]
public PartialViewResult AccountHeader() {

blah...blah...

}

Upvotes: 5

Related Questions