Greetings,
This problem is two fold, so I'll quick try to explain what's going on. Here's the setup.
I've installed a fresh DNN 3.2.2 into a new web site (not the Default or a virtual). Because I don't entirely trust 3rd party software solutions for maintaining SSL coverage, I've decided to turn on SSL under the web site's Directory Security tab in IIS 6.0 Manager. Because I want to allow redirection, I then turned off the SSL protection on the splash file Default.aspx and add some redirecting ASP.
The first problem I ran into was that apparently if you have the "Require SSL" option turned on at the site level, even though you might have the SSL turned off on the default content, http://soandso.com and http://soandso.com/index.html do NOT behave the same. The first will fail with a 403 error (https required) and the second will succeed.
So I thought, I'll just turn off the SSL at the site level, put the redirecting code in a separate file. Turn SSL off on this file. Then turn SSL on for all the other top-level folders and files. This way the default page isn't SSL required, but everything else should be.
Wrong again! Apparently with the Friendly URL feature turned on, SSL is totally confused and while under this setup https://soandso.org/Default.aspx?tabid=53 is secure, https://soandso.org/Blog/tabid/53/Default.aspx is still being served over unsecured channels.
Surely there's something going on that I'm missing. I can and will be turning off Friendly URL's, but something here just doesn't seem right.
Casey