We recently implemented SSL on our reseller portal and have been receiving complaints about needing to log in twice. This is of course because they bookmarked the site before we had SSL so their bookmark is HTTP. The only way I could figure out how to implement SSL was via VB.NET code, so they have to authenticate first against HTTP, then they are redirected to HTTPS, which requires them to authenticate again.
I have previously tried forcing SSL using settings in IIS, with a custom 403:4 error page, but this causes multiple logins followed by an access denied message. Based on my limited knowledge of server configuration, I've come up with the following theory: allow the user to access HTTP without authenticating.
Is it possible to have two sites with the same host header, one listening on port 80 and the other listening on 443? Or is there some simple solution that I'm not aware of?
We are running IIS6 on Windows 2003 Server. The entire site is protected with NT authentication.