Securing Data Transmissions with HTTPS in ASP.NET: A Plesk Panel Guide

A padlock in the address bar protects only one connection: the visitor's browser talking to your site. An ASP.NET app sends data along several other routes too: to its database, to the mail server, to payment gateways and other APIs, and from your computer when you deploy. This guide goes through each connection on Domain India Windows hosting and shows how to keep the data on it encrypted.

1. Map your app's connections

2. Browser to site: HTTPS end to end

Install the free Let's Encrypt certificate in Plesk and force HTTPS in one place: the Plesk Permanent SEO-safe 301 redirect from HTTP to HTTPS option, a web.config rewrite rule, or UseHttpsRedirection() in ASP.NET Core. Then:

• HSTS: app.UseHsts() in production, once every address you use has a certificate.
• Cookies: mark authentication and session cookies Secure and HttpOnly.
• Forms and links: make every form post to an https:// or relative URL, so data is never submitted over HTTP.

For .NET Framework, the equivalent web.config rule is:

<system.webServer>
  <rewrite>
    <rules>
      <rule name="Redirect to HTTPS" stopProcessing="true">
        <match url="(.*)" />
        <conditions>
          <add input="{HTTPS}" pattern="^OFF$" />
        </conditions>
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

Use it instead of the Plesk option, not as well.

3. App to database

Current SQL Server client libraries (Microsoft.Data.SqlClient 4.0 and later) encrypt the connection by default and check the server's certificate. If the check fails, you see "the certificate chain was issued by an authority that is not trusted". The fix used on hosting is:

Server=DB_HOST;Database=DB_NAME;User ID=DB_USER;Password=DB_PASSWORD;TrustServerCertificate=True;

TrustServerCertificate=True keeps the connection encrypted and skips only the certificate check. Don't add Encrypt=False to silence errors. Your app reaches the database from the hosting server; the SQL Server port is closed to the outside world. Details: What to use for the MSSQL connection string.

4. App to mail server

Send through mail.yourdomain.com on port 465 with SSL/TLS from the first byte. Port 587 is closed on Windows hosting. .NET's System.Net.Mail.SmtpClient can't use port 465, so use MailKit with SecureSocketOptions.SslOnConnect. The code is in Configuring email for ASP.NET in Plesk.

5. App to payment gateways and APIs

• Use https:// URLs only for every API your app calls.
• Leave certificate validation on. Never set ServerCertificateCustomValidationCallback to accept any certificate, or ServicePointManager.ServerCertificateValidationCallback to return true. That turns HTTPS into an unauthenticated connection anyone in between can read.
• Let the operating system choose the TLS version. On .NET Framework, target 4.7 or later and don't hard-code ServicePointManager.SecurityProtocol, so connections use TLS 1.2 or newer as the server supports. Modern .NET does this by default.
• Reuse HttpClient through IHttpClientFactory in ASP.NET Core rather than creating one per request.

If an API call fails with a certificate error, check the URL and the provider's certificate, not the validation setting.

6. Payment and webhook callbacks

Payment gateways call back to your site to confirm payments. Register the callback URL with https://, verify each callback's signature as the gateway's documentation describes, and never trust an amount or status sent from the browser alone.

7. You to the server

• Plesk: open it with the Plesk button in the client area, or at https://yourdomain.com:8443. Both use HTTPS.
• FTP: in FileZilla or WinSCP choose Require explicit FTP over TLS on port 21. Plain FTP sends your password unencrypted. Windows hosting has no SSH or SFTP.
• Webmail and mail apps: include webmail and mail in your Let's Encrypt certificate so those connections don't show certificate warnings.

8. Where Domain India Windows hosting fits

Every Windows plan includes free SSL, Plesk over HTTPS and FTP with explicit TLS. The cards show live prices, excluding 18% GST.

For hardening beyond encryption, such as passwords, errors and updates, see How to secure your ASP.NET applications on Plesk.

Ready to secure your ASP.NET app end to end? Compare the Windows hosting plans, or open a ticket if a TLS error won't go away. Support is on 24/7 live chat, and tickets get a first response within 15 minutes.