Good day.

The essence of the question is set out in the title. Do I need to manually create a certificate and twist it to IIS? Or is it enough just to register something in the Web.config file ??? Or do you need to specify [RequireHttps] before each method of all controllers ??? If there is normal documentation, poke your nose, please, because I haven’t found anything really useful ...

    2 answers 2

    Yes, the certificate needs to be tightened up in IIS, the instruction and free certificate for a year can be found, for example, here .

    Also, in IIS to work on the HTTPS MVC site, you must specify the binding to https:

    enter image description here

    If you are not going to use secure and normal HTTP for the site at the same time, then you do not need to specify any attributes, as well as edit Web.config - IIS will not respond to regular HTTP requests.

      If you create a certificate for the server yourself (self signed certificate), then many browsers will issue a warning message to the user.

      To prevent such a warning, you need to order / buy an SSL certificate from verified certification authorities. This can be done, for example, with domain registrars or hosting providers.

      How to configure the SSL certificate in IIS can be found here .

      How to make the ssl-certificate in IIS yourself here .

      The web application will work without any edits in the web.config.

      The RequireHttps attribute requires calling the marked methods (Action) over HTTPS.

      • The procedure for creating a self-signed certificate under Windows is familiar to me, then you can put it into trusted root, and then browsers will start working in normal mode. I was hoping that there was a better way than screwing the certificate to IIS. Hence, RequireHttps just tells the application to use https, but if it is not configured, it will not work. And how to configure the use of https by default for all action? - neo
      • RequireHttps can be added to the controller. It is possible so GlobalFilters.Filters.Add (new RequireHttpsAttribute ()); And another option is to configure WebSite in IIS with the attribute to always use SSL. - pavelip
      • understood, thanks!) - neo