6

For reasons much too long and complex to get into (it involves several layers of corporate red tape resulting in someone else not purchasing a wildcard SSL certificate I requested), I have to set up a domain to redirect all requests to https://www.example.com – secure protocol with the www subdomain.

EDIT: The SSL certificate is only valid for the www.xyz.com domain.

So: http://example.com, http://www.example.com, and https://example.com should ALL redirect to https://www.example.com.

My .htaccess-fu is weak at best and I can't seem to get this to work. Note: hosting is on Media Temple if that makes a difference.

So far, my .htaccess file looks like so:

RewriteEngine On
RewriteCond %{HTTPS} !^on$
RewriteRule (.*) https://www.example.com/$1 [R,L]

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

Both http://example.com and http://www.example.com are redirecting to https://www.example.com, so yay. However, https://example.com is not redirecting to https://www.example.com and is thus throwing a security warning page:

This is probably not the site you are looking for!
You attempted to reach example.com, but instead you actually reached a server identifying itself as www.example.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of example.com.
You should not proceed, especially if you have never seen this warning before for this site.

Any help in getting me past this one final hump would be muchly appreciated!

5 Answers 5

8

You need a certificate that is valid for both example.com and www.example.com if you're going to rewrite those requests to www.example.com (or two separate certs that accomplish this). There's no way around this.

4
  • Drat, that's what I was afraid of. Probably easier/cheaper to just get a second cert for the non-www subdomain rather than a wildcard, then. Thanks!
    – Scott
    Jul 14, 2013 at 10:52
  • No problemo. Good luck!
    – MDMarra
    Jul 14, 2013 at 10:55
  • Just as a note regarding the follow-up: This seems like a case where a SAN certificate seems more appropriate than a wildcard cert. In fact, many CAs seem to hand out SAN certs with both www.example.com and example.com more or less as a standard feature even for their cheapest certificates. Jun 1, 2014 at 18:09
  • If anyone is stumbling across these comments in 2020 and beyond, please note that SSL certificates can now be obtained for free with a service like Let's Encrypt. Aug 2, 2020 at 4:22
9

@Simbus82 is right about inverting the rules. Here is an approach that is slightly more universal.

RewriteEngine On
# ensure www.
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ensure https
RewriteCond %{HTTP:X-Forwarded-Proto} !https 
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
1

Invert the rules ;-)

i'm using this and i had your problem

RewriteEngine On

RewriteCond %{HTTP_HOST} ^site.it [NC]
RewriteRule (.*) http://www.site.it/$1 [L,R=301]

RewriteCond %{SERVER_PORT} ^443$ [OR]
RewriteCond %{HTTPS} =on 
RewriteRule ^(.*)$ http://www.site.it/$1 [R=301,L]

First rewrite to www and then check https.

0
1

This is a very complex question. Most tutorials on the internet will tell you, like Simbus82, to just invert some lines of code inside htacess. This will not always work (especially if you have an SSL offloading equipement in front of Apache)

You have a few options to solve the problem :

  • Use the http://redirect.name, service. Risk of this solution : depending on a 3rd party. It works ONLY for HTTP requests redirect to HTTPS, so no help for redirecting https://example.com to https://www.example.com
  • Put a "URL" record in your DNS, if your registrar supports it
  • As MDMarra said, buy a wildcard (or multi domain) HTTPS certificate.

I can't explain why, but it looks like the SSL protocol checks the domain/subdomain certificate issue, before handling the request to Apache.

2
  • I think you may have missed the part about the warning being produced by the client rather than the server. Of course the client shouldn't trust redirects from a server with a certificate from a different domain than the client expected to see. I don't see how the redirect.name service would help the slightest since it doesn't support HTTPS. (Which makes sense, because in order to support HTTPS that service would need to have a certificate valid for all domains.)
    – kasperd
    Sep 30, 2015 at 7:56
  • Right, kasperd, I got confused. The redirect.name will work only for http requests redirect to https, which is part of the two domains Scottie succeeded to redirect. So it won't help (although it can be relevant for others). Editing my answer to make it clear
    – u425204
    Sep 30, 2015 at 10:07
0

My .htaccess knowledge is weak as well, but what about an alternate solution?

Can you redirect all http://example.com to http://example.com/redirect.html and have a button there they can click on? Explain on the page what you are doing.

Could you even make that a timed redirect in JavaScript or something?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .