Hi all,

We are trying to utilize the SSL capabilities of DNN. We have created, purchased, and installed our Verasign certificate, ad everything works as expected except for one thing. 

For some reason, when we select both "SSL Enabled" and "SSL Enforced" in site settings, when we are going from an SSL-enabled page to a non-SSL enabled page, we see in the top of the page the redirect url, fully qualified (ex. http://abc.com/Default.aspx - sorry the real site is internal right now).  

We can avoid this for the most page by unchecking "SSL Enforced", however, that means as soon as the user hits one ssl page, the rest of the sesion stays in SSL (obviously a big waste of server resources, as the vast majority of our pages don't require ssl).

We are running in a load-balanced environment (a pass through load-balancer in front of 2 webservers), but even when we turn off one of the servers we still have the issue.

Has anyone else experienced this issue? We are running vanilla DNN4.9.5, with very few modules installed.

I have looked at posts explaining how dnn does its SSL (like this one from Joe Brinkman),

http://blog.theaccidentalgeek.com/?ta...

and I understand the double page hit to switch the protocol, we just don't understand the stray uri being written before it redirects with the "SSL Enforced" checked. 

thks,

Phil

Thanks for the reply. The issue is, we get a stray url (the http url that is being redirected to)  in the browser itself whenever a user is switching from https page back to an http page (but not the other way around) when we have "Enforce SSL" checked. Since the majority of our site is not ssl, we really want to check this so that we can push a user back into non-ssl once they go to an unsecure page.

Sorry I can't show it because the site is internal, but we have not been able to determine if this is a configuration issue in the environment, or if this is a dnn issue. Running Fiddler, and looking at posts like Brinkman's, we know that going from an http page to an http page requires an intermediate https to the 2nd page BEFORE it redirects to http, its right when it does the redirect that we see the url in the browser briefly before the redirect completes. 

Just trying to determine if its DNN or something with our configuration. thks.

 phil

Thanks Crispy, but the issue is that when it switches from https to http, it places briefly a url of the http page on the screen itself before it does the redirection (i do understand how dnn is handling the redirections when the protocol changes).

Its either incorrectly writing a header, or there is a redirection problem. I know this is hard to explain (wish I could show it), but its either an issue with the way dnn writes the headers or something with the way our infrastructure people have configured the environment. Either way, it looks bad, so we've got to figure out how to surpress it. I am ultimately hoping someone else has run across this problem, and can help us resolve it. 

thks