Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that you can provide SSL at any subdomain with a wildcard SSL cert, but how can you do that and also have SSL at the root (ie, when somebody just types https://example.com/ without the www)? Would I just install the wild card cert, and a second cert for handling root :443 requests? I can't use mod_rewrite because the browser won't get that far before alerting the user of the lack of an SSL.

share|improve this question

migrated from stackoverflow.com Mar 9 '10 at 12:36

This question came from our site for professional and enthusiast programmers.

4 Answers 4

up vote 2 down vote accepted

One certificate with all the domains described in the 'X509v3 Subject Alternative Name' attribute may do the job. Most modern web browsers support this AFAIK, though I am not sure if the well-known commercial CAs do issue such certificates.

share|improve this answer
2  
wiki.cacert.org/VhostTaskForce –  grawity Mar 9 '10 at 21:41

Many CAs (including Comodo, and DigiCert) will include the base domain name as a free SAN in their wildcard certificates: http://www.sslshopper.com/ssl-certificate-comparison.html?ids=26,13,45

So you could use the one wildcard certificate to secure domain.com and anything.domain.com. That way you don't get any errors, but you still might want to redirect them to www.

share|improve this answer

You need 2 certificates for this to work I'm afraid.

share|improve this answer
    
AFAIK, you can only use 1 certificate per ip-address. –  Ger Apeldoorn Mar 9 '10 at 13:09
    
vorik: "TLS Server Name Indication" –  grawity Mar 9 '10 at 21:40

I'm using mod_rewrite for this purpose just fine, I redirect request from https://domain.com/application/ to https://www.domain.com/application/ using the following rules:

RewriteEngine On

# Use correct hostname
RewriteCond %{HTTP_HOST} ^domain\.com$
RewriteRule ^(.*)$ https://www.domain.com/$1 [R=301, L]

So you'd just need one wildcard SSL certificate.

share|improve this answer
    
@Matthias Vance How does that work. If the user reaches https://mydomain.com first, there browser will try to connect via SSL and fail before a redirect can be issued, right? –  orokusaki Mar 10 '10 at 3:22
    
I tested this on one of our systems, but that happens to have a root and "www." certificate. So, the test is flawed, but I think it's still worth trying out out, because the SSL certificate will get sent, no matter what hostname you use (over SSL). So the browser should get the redirect just fine. –  user215361 Mar 10 '10 at 7:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.