if you disable "use SSL" on site level, DNN should use http for all pages and system links (absolute link you added in content will not be affected). You might need to restart DNN after modifying the settings.

I made sure that SSLEnabled and SSLEnforced in table PortalSettings are both 'False' for all portals and restarted. (BTW: when I set both to 'True' for a portal that uses a proper certificate, I get ERR_TOO_MANY_REDIRECTS and that is that.)

After the restart, the links in the non-SSL sites still point to https. I am talking about menu links and other DNN generated links.

I am not sure if there are any other settings in DNN that are relevant in that respect.

When you say that the links point to https, is this in the page source and/or is it in the database?

Is there possibly some redirect happening? You might use Fiddler to help figure that out.

Thank you, Craig. I checked with Fiddler, there is no redirect happening as far as I understand the output. I tried with https://www.poehlerthomas.de and I typically see a lot of "Tunnel to" entries with "CONNECT http://www.poehlerthomas.de:443
200 Connection Established ()". I tried with cache on and off, I haven't used Fiddler for a while and the result is inconclusive to me.

On the top of https://www.poehlerthomas.de is a DNN menu, and I would expect the menu entries to point to HTTP addresses. Instead, for example the "Aktuell" link points to https://www.poehlerthomas...guage/de-DE/Aktuell. There is also an "Impressum" link, which is generated via DotNetNuke.Common.Globals.NavigateURL, and that method also generates an HTTPS link.

I am sure this is new behaviour, but I am not sure if upgrading to 9.9.1 or other stuff that I changed to add Let's Encrypt to other portals is the reason for the https links. For example I added a certificate for www.aivest.com. Everything works fine there - https links of course.

So ssl is disabled for all my sites in DNN, but all sites generate https links.

Most likely, Azure enforces https (but due to a missing certificate, the browser issues an error) and all local links are formed using the same protocol and domain address.
You either need to make sure on IIS level to use always http or install an appropriate SSL certificate for this domain (preferable), which shouldn't be expensive ;)

I was thinking the same thing but "HTTPS Only" is deactivated in Azure App Services. Maybe there is something else trying to force https, but I wouldn't know what.

You are certainly right in that the better solution is to assign certificates for the remaining domains. The ACME bot that I am using now (https://github.com/shibayan/keyvault-acmebot) requires access to the DNS server, so for my domains I am using Azure DNS now. But I cannot change the nameservers of the remaining sites right now, which is why I kept trying to use http for those sites. But I found out that the security warning is only appearing once per site, so for a temp situation it's not that bad.

the issue must be IIS domain binding - which supports HTTPS, but uses a azure certificate instead of a custom one. If you can't use a free certificate I'd consider buying a cheap SSL one, e.g. from sslpoint.com

Sounds like IIS is forcing HTTPS and falling back to the Azure cert. If you can’t fully turn off SSL, the simplest workaround is to put a real cert on the site. Doesn’t have to be pricey, even a basic one from cheapsslweb.com is enough.