SSL encryption on self hosted OWIN WebAPI

Question

I'm creating a self hosted OWIN-based WebAPI with Static Content. Without ssl everything works as it should, but i don't really know how to implement ssl.

I read the guides here and here, but the question is: do I need to secure the port, that is used by the webapi (in my case: 9000) or the standard 443 port?

The Static Content should be a simple url like www.mysupergreatsite.com (without port). When calling the url, the browser should be redirected to the static files... to the port 9000 i guess?!

Is it a good way to make a litte redirection site somewhere else (e.g. iis)?

Answer 1

You want to run SSL into the port that faces the outside world. It doesnt really matter which port that is, but by convention 443 is the default for SSL, and therefore doesnt need an explicit port. If you dont want your users to have to enter a port explicitly, then you either need to

• Run your application on port 443 or
• Change the default SSL port

Changing the default port can be done IIS when you create your site binding: