Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a site that is using an Execute URL in the 403.4 error page slot that calls a page named forcessl.aspx. Here's the contents of the file:

strWork = Replace(strQUERY_STRING, "http", "https") strWork = Replace(strWork, "403;", "") strWork = Replace(strWork, "80", "") strSecureURL = strWork Response.Write(strSecureURL) Response.Redirect(strSecureURL) Catch ex As Exception End Try End If %>

This particular site gets a 401.1 error if https:// is not added to the URL. I have several other sites using the same method that work fine and this one mirrors those in all ways that I can tell (folder permissions, etc). This new site is just a subdomain of the same domain that the other sites are using. The main domain has a wildcard SSL cert.

From Microsoft's documentation, here is the meaning of the errors:


HTTP Error 403.4 - Forbidden: SSL Is Required To View This Resource


HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials

share|improve this question
You could probably easily fix this with a rewrite rule to redirect error pages to https. I think that is what you are trying to accomplish? – Frank Sep 22 '14 at 12:38
I'd never heard of 403.4 or 401.1 errors. The decimal point on them seems to be a Microsoft invention for keeping different reasons for those errors straight. I've added information about the errors to the question. – Stephen Ostermiller Nov 14 '14 at 15:27

I finally found the solution to this problem.

When setting up the site I had done everything but put the site in the bindings for the domain. I hadn't added the subdomain.mysite.com to the bindings for port 80.

I had forgotten this because since I was forcing everything through port 443 with a rewrite, I didn't think I needed to add it. In digging around for the solution I saw that all the other subdomains were in the bindings and this one wasn't.

A simple little thing caused 6 months of frustration. What was weird is that it worked for some people, but not for others if you tried to access it through HTTPS.

Always learning.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.