title: Configuring SSL in IIS / ASP.NET
body: <p>I'll try to be as brief as I can. I have the certificate already setup on my server. I just have a question about the.. proper way of configuring the ssl in my website.  </p>
  
  <p>I need to secure at the root <code>login.aspx</code> and the <code>admin</code> and <code>cart</code> directories. So in IIS, you can right-click a file or directory in the site and go to <code>Properties</code> -> <code>File/Directory Security</code> tab -> <code>Secure Communications</code> section and click <code>Edit</code> -> check <code>Require secure channel (SSL)</code>. This causes the file or directory contents to be requested over <code>https</code> connection, and asp.net will not convert the request automatically.</p>
  
  <p>So, instead of changing all of my links and redirects to use absolute URLs to specify <code>http</code> or <code>https</code>, I implemented an <a href="http://www.codeproject.com/Articles/7206/Switching-Between-HTTP-and-HTTPS-Automatically-Ver" rel="nofollow noreferrer">http module</a> to automatically switch between between <code>http</code> and <code>https</code> as suggested <a href="https://stackoverflow.com/a/12222195/550309">here</a>. However, I still get the error:</p>
  
  <blockquote>
    <p>The page must be viewed over a secure channel</p>
  </blockquote>
  
  <p>because it was not <em>initially</em> sent over <code>https</code>, but converted in the module. If I remove the setting in IIS, it works fine; the page module automatically switches the connection to <code>https</code>. My question is, is it okay to not have the SSL requirement setting in IIS and just have my http module handle the http/https switching? I feel like I will be losing a layer of security here by doing so. Does anyone have any insight on this?</p>