getting https to work locally in asp.net MVC4 application

Question

I followed this tutorial exactly:

http://www.hanselman.com/blog/WorkingWithSSLAtDevelopmentTimeIsEasierWithIISExpress.aspx

But when I am running locally and try to navigate from a non-https page (like home/index) to and a page I decorated with [RequireHttps] I get the generic "SSL connection error" message.

I hate posting such a generic question, but can you think of anything I have missed? It is a large asp.net mvc4 application, I enabled ssl in the project, it shows the ssl url. Navigating to the ssl url manually does not work either.

HALP!

NOTE: Using IIS Express with visual studio 2012

Per the comment, the error I am getting is Cannot Establish SSL connection.

I think you should expand on what you mean by "generic SSL connection error". Cannot establish? Bad/untrusted cert?, how far did you go? Port 443? And if so, did you makecert? — EdSF
– EdSF, Commented Dec 3, 2012 at 18:51
it will take me to "localhost" and give me the error then. I did perform a makecert command as per the steps in the link. — ledgeJumper
– ledgeJumper, Commented Dec 3, 2012 at 22:04

Jack · Accepted Answer · 2012-12-19 07:26:01Z

You shouldn't be using Https when testing locally. I've created my own Https Filter where it will ignore all the local traffic in the localhost and only works either on staging and live environment. You can modify the code to suit you need.

public class RequireSSLAttribute : FilterAttribute, IAuthorizationFilter {
    public virtual void OnAuthorization(AuthorizationContext filterContext) {
        if(filterContext == null) {
            throw new ArgumentNullException("filterContext");
        }

        if(!filterContext.HttpContext.Request.IsSecureConnection) {
            HandleNonHttpsRequest(filterContext);
        }
    }

    protected virtual void HandleNonHttpsRequest(AuthorizationContext filterContext) {
        if(filterContext.HttpContext.Request.Url.Host.Contains("localhost")) return;


        if(!String.Equals(filterContext.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase)) {
            throw new InvalidOperationException("The requested resource can only be accessed via SSL");
        }

        string url = "https://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
        //ignore if the request is from a child action
        if(!filterContext.IsChildAction) {
            filterContext.Result = new RedirectResult(url);
        }
    }
}

And this is how you use it...

[RequireSSL(Order=1), Authorize(Order=2)]
public PartialViewResult AccountHeader() {

blah...blah...

}

Patrick Stephansen · Accepted Answer · 2014-03-18 09:09:52Z

4

I know it's already answered, but I thought I'd point out the cause of the original error, which the other answers omit.

When you enable SSL on IIS Express, your site is hosted on 2 ports, 1 for http and another for https. When you debug in Visual Studio, the port is usually specified explicitly. The links on your site probably don't specify port numbers, so when you link from a plain http page to a https one, the port number won't change, and you'll request a https page on the plain http port. This is why you get the SSL connection error.

On a real server the port numbers should be implicit, so the problem shouldn't come up, but you'll need to make sure you're using the right port when debugging locally.

answered Mar 18, 2014 at 9:09

Patrick Stephansen

81810 silver badges21 bronze badges

Comments

Dima · Accepted Answer · 2013-11-07 04:53:25Z

3

You need to add ssl certificate to your site instance in IIS. To create certifiacte and add it to IIS7 try this tutorial: http://technet.microsoft.com/en-us/library/cc753127(v=ws.10).aspx

After creation you'll be able to add it to your website. Open in IIS 'your website' -> Bindings -> Add and add new host header. Select https, port 443 and select created sertificate.

edited Nov 7, 2013 at 4:53

answered Dec 3, 2012 at 18:26

Dima

6,7414 gold badges26 silver badges43 bronze badges

2 Comments

ledgeJumper Over a year ago

I should have mentions I am using IIS Express, does this also apply to that?

EdSF Over a year ago

You only need to create a cert if you are going to use port 443. Otherwise, simply using IIS Express, then using the specific URL and PORT (no cert) e.g. https://localhost:44300/ will work during local dev.

Collectives™ on Stack Overflow

getting https to work locally in asp.net MVC4 application

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related