Perhaps it is because
pattern
is mis-spelled
<add input="(https)" patern="off"/>
<add input="{HTTPS}" pattern="^OFF$" />
Also... you may want to change the
redirectType
attribute to Permanent; this will generate a 301 Permanent Redirect as opposed to a 302 Found response.
This is good for SEO purposes as well:
1. Search Engines will give you credit for using an SSL
2. Search Engines will index the HTTPS version and not the insecure version
3. Browsers cache the 301 response, and will not ask for the insecure URL in the future