DNN Forums

Ask questions about your website to get help learning DNN and help resolve issues.
Prev
Next

SSL enforce on Azure-host: web.config vs. App Service setting vs. DNN settings?

Forums > Installing DNN Platform
Sort:
You are not authorized to post a reply.





David Fenske

New Around Here



Posts:27
New Around Here




7/11/2022 11:59 AM

    Hi all,

    I'm in the midst of troubleshooting some intermittent SSL connection failures, and in reviewing all my settings, I find myself a bit confused on how they interrelate. 

    We used to use traditional IIS hosting, and I would use the URL rewrite tool to add 301 redirects of all HTTP requests to HTTPS (and later just directly in the web.config). We've moved to Azure, and I've retained those web.config settings, but also flip the "HTTPS Only" setting of the App Service to ON. 

    However, I had totally forgotten in DNN Persona Bar > Security > More Settings there are a couple of switches to "Enable" and to "Enforce" SSL. Should I also have these switched on? They are currently off, and in general, I don't find any issues - but as part of my troubleshooting for some edge cases where I get SSL connection errors, is this perhaps an issue...?

    Thanks for your perspective!
    David






    Timo Breumelhof (40F)

    Veteran Member



    Posts:1094
    Veteran Member




    7/12/2022 6:38 AM
      Posted By David Fenske on 11 Jul 2022 12:59 PM

      Hi all,

      I'm in the midst of troubleshooting some intermittent SSL connection failures, and in reviewing all my settings, I find myself a bit confused on how they interrelate. 

      We used to use traditional IIS hosting, and I would use the URL rewrite tool to add 301 redirects of all HTTP requests to HTTPS (and later just directly in the web.config). We've moved to Azure, and I've retained those web.config settings, but also flip the "HTTPS Only" setting of the App Service to ON. 

      However, I had totally forgotten in DNN Persona Bar > Security > More Settings there are a couple of switches to "Enable" and to "Enforce" SSL. Should I also have these switched on? They are currently off, and in general, I don't find any issues - but as part of my troubleshooting for some edge cases where I get SSL connection errors, is this perhaps an issue...?

      Thanks for your perspective!
      David

      You can ignore all DNN settings for SSL if they are already handled on a higher (e.g. hosting) level.

       

       

      40FINGERS Web Solutions · Style Helper · DDR Menu Demo Skins · SEO Redirect
      You are not authorized to post a reply.

      These Forums are dedicated to the discussion of DNN Platform.

      For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

      1. If you have (suspected) security issues, please DO NOT post them in the forums but instead follow the official DNN security policy. 
      2. No Advertising. This includes the promotion of commercial and non-commercial products or services which are not directly related to DNN.
      3. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
      4. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
      5. No Flaming or Trolling.
      6. No Profanity, Racism, or Prejudice.
      7. Site Moderators have the final word on approving / removing a thread or post or comment.
      8. English language posting only, please.

      Would you like to help us?

      Awesome! Simply post in the forums using the link below and we'll get you started.

      Get Involved