KNOWLEDGE BASE

Let's Encrypt offers a neat service providing free SSL certificates which can be renewed through a service. However, the renewal process itself can be tricky : it requires the Let's Encrypt servers to access to your server's filesystem along a non-HTTPs connection. This may sound simple, until you consider that you may also want to have a generic redirect from all other non-HTTPs requests to their HTTPs equivalent.

So how do you include the best type of 301 redirect, while also separately allow through any requests to the required to the ./well-known folder and all of it's sub-folders? Luckily redirects are infinitely configurable in IIS, and below are some of the ways we have achieved this using Web.config redirects

This is specified as two rules, the first saying to 'take no action' for any requests that includes .well-known/<anything>, thereby causing IIS to ignore the second rule which says "redirect all requests that are not HTTPs to the corresponding HTTPs equivalent. So accessing http://mysite.com/anything will automatically redirect (with a 301 to https://mysite.com/anything  unless the .well-known pattern is found at the start of the request.

<!-- Add to web.config in system.webserver element -->
<rewrite>
            <rules>
                <rule name="Allow LetsEncrypt" patternSyntax="Wildcard" stopProcessing="true">
                    <match url=".well-known/*" />
                    <action type="None" />
                </rule>
                <rule name="Redirect HTTP to HTTPS" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*" ignoreCase="false" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" />
                </rule>
            </rules>
        </rewrite>