Redirect from https to http when the SSL cert is no longer valid

Question

I have an IIS 6.0 server and I'm no longer using an SSL certificate (Don't need it anymore because of some functional changes, don't have a valid one I can use). Is there a way for me to redirect users to the http site who already have the https one bookmarked?

I tried using a self signed certificate and rewriting the URL to the http version but browsers get a warning about the self signed certificate before I can redirect using web.config.

I also tried removing port 443 as an HTTPS binding and adding port 443 as an HTTP binding but it didn't work. When I tried to start the web site I got an error indicating the port was already in use.

Answer 1

No, you can't.

Redirections from HTTPS to HTTP happen after the initial HTTPS request has been made, and this request expects a valid certificate to be used. If what you'd like to do was possible, downgrade MITM attacks would be far too easy to perform.

Perhaps turning off port 443 completely might make your users try plain HTTP too, although they really should consider this to be a potential attack if they don't know your site.

Answer 2

It is not possible what you want because it first has to do the SSL connect (which causes the warning) before it gets the HTTP redirect. And, this questions is asked nearly daily so you should have find enough answers to it.