Hi all,
After i locked down a Win2003 Server I installed a certificate, checked the
"Require secure channel (SSL)" , but i can still logon to this web
application over http. https is working also fine.

Any Ideas?

Thanks,
Shif

"Require Secure Channel (SSL)" applies at a per-URL basis.

Port 80 functioning applies at a per-ServerBinding basis.

The two are not equivalent unless you mark the root of the website as
"Require Secure Channel" and it inherits throughout the website -- so the
fact that both HTTP and HTTPS work with "Require Secure Channel" depends
totally on your configuration, which you did not provide.

Please provide:
1. Exact URL that works for both HTTP and HTTPS
2. The value of the AccessSSLFlags property that applies to that URL

I suspect you have some non-obvious misconfiguration, perhaps via an
IIsWebFile, by accident.

Show quoteHide quote

Muliple Websites on Mutliple IP address with certicles [SSL]
File permissions vary based on access method problem
default scripts and manuals
IIS auth. problem with 2003 SP1
Remote administration security group.....
Strange issue with Integrated authentication and 3G
IIS IP and domain name restrictions - automated access denial
Integrated windows authentication problems
IE prompts for username password when saving excel file opened in
Active Directory check with login details on DB