Force https with URL rewrite

For most sites, after installing a SSL certificate, https can be forced by adding a URL rewrite rule to the site's web.config file. Though, please note it will not apply to all sites, for example it may not work for those using routing or it may conflict with any existing URL rewrite rules. In the case of a CMS like WordPress or nopCommerce, it is often a setting within the CMS itself. The URL rewrite rule will not always work for ASP.NET Core sites (see below for more information).

URL rewrite rule to redirect all requests to https

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Redirect to https" stopProcessing="true">
          <match url=".*" />
          <conditions>
            <add input="{HTTPS}" pattern="off" ignoreCase="true" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" appendQueryString="false" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>

Redirect to https in Core

For Core apps, UseHttpsRedirection middleware can be used to force https by adding app.UseHttpsRedirection(); to the program.cs as in the example below

var builder = WebApplication.CreateBuilder(args);

var app = builder.Build();

  app.UseHttpsRedirection();

More detailed information can be found after the link https://docs.microsoft.com/en-us/aspnet/core/security/enforcing-ssl

Securing domain pointers with a single domain certificate

Because multi-domain certificates can be cost prohibitive or less than straight forward to order, a workaround is using domain forwarding and flexible SSL through cloudflare.com. Flexible SSL means the connection is secure between the client and cloudflare, but is not secure between cloudflare and the site. So it shouldn't, for example, be used to secure a subdirectory pointer. But is sufficient when a domain pointer is only an alternate address for a site. Please note that this will assume some familiarity with cloudflare since it is an external service.

Add the domain pointer as a website in cloudflare and then when viewing the domain Overview, expand SSL, click Overview, then Configure, select the Flexible radial button and then Save.

Now create the domain forwarding rule by expanding Rules then clicking Page Rules.

In the URL field enter the domain being forwarded.

For Then the settings are select "Forwarding URL" and "301 - Permanent Redirect" and enter the primary site domain in the "Enter destination URL" field.

Save and Deploy

After creating a rule for the root domain, create a second rule for URL "www.forwardedDomain.com" or "*.forwardedDomain.com" with the same destination URL.

Article ID: 1523, Created: 7/5/2018 at 2:52 PM, Modified: 10/19/2026 at 12:29 PM

Force https with URL rewrite

Was this article helpful?