Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a web application located at:

With an SSL certificate issued to "",

What is are the proper rewrite rules, DNS settings, or combination of both which makes each of the below urls redirect seemlessly to


The difficulty is really with #3. tends to cause browser security messages. How do the major HTTPS sites do this? Take, for instance.

share|improve this question
up vote 3 down vote accepted

As some more assistance for item 3, and maybe 2 as well, how about using Server Name Indication to use two certs on the same host. (ie: and Apache's Wiki has some info on the specifics.

--Christopher Karel

share|improve this answer
I'm selecting this as the answer because it comes closest to stating the solution, which is I believe that two separate certificates (one for ""; and one for "") are required for no. 3 to work seamlessly. There isn't apparently, as I was hoping to find, a way of taking care of this with DNS configuration (by somehow routing requests to "" to "" without ever talking to the webserver, which causes a warning -- someone please correct me if I'm wrong). Esp since this is what Paypal does, I'll take that as the best practice solution. – perrierism Jun 23 '10 at 18:34

Followup to James's Answer:

RewriteCond %{HTTP_HOST} !^$    [OR]
RewriteCond %{HTTP_PORT} !^443$
RewriteRule ^(.*)$$1 [R=301,L]

This still doesn't fix #3, you'd need a wildcard or UCC cert for that.

share|improve this answer
OK, #3 is exactly what I'm looking to fix. Can you elaborate on what you mean by wildcard or UCC cert? – perrierism Jun 22 '10 at 18:59
@perrierism: you can get a wildcard certificate that covers * (this includes You can also get a UCC Certificate which contains multiple Subject Alternate Names (ie, and both on the same cert) (Note that UCC have just one SN, so anyone looking at the cert will only see one of the names "featured" on it). – Chris S Jun 22 '10 at 19:17
FYI, I don't think wildcard certs will work here. I just tried it with FireFox3 and one of our sites using a wildcard. It seems to choke, because doesn't use a subdomain. Doesn't look like the wildcard will match 'none'. UCC may be you're only real bet. – Christopher Karel Jun 22 '10 at 19:36

I think the easiest option is to use mod_rewrite in an htaccess file or right in your httpd.conf. Here is what I use to forward the first two that you need:

RewriteCond %{SERVER_PORT} 80
ReWriteRule ^(.*)$$1 [R,L]

So, to forward to, you could do:

RewriteCond %{SERVER_PORT} 443
RewriteCond %{HTTP_HOST} ^
RewriteRule ^(.*)$$1 [R,L]

I'm sure there is a way to consolidate those two rule sets if you want to try. Not around my apache server at the moment to test it.

share|improve this answer
This is basically what I arrived at. Good summary of the rules. I run into a problem though with this when redirecting to, because the browser first talks to ""; before getting redirected, and since the server is carrying a certificate that is only valid for "" the browser gives a warning. I'm wondering if you get around this with some sort of DNS redirects... of if you actually need a certificate also issued to to avoid the warning. – perrierism Jun 22 '10 at 18:56
Hmm... now that I think about it. You're right. Let the trickiness of #3 begin. I think technically, you do need a certificate for that is valid. Though, I know a lot of SSL certificate CA's that give you a single domain certificate that includes both and Who's your CA? – James Jun 22 '10 at 19:06
I'm using verisign. When I created the signing request I could only specify one domain and I chose "". I think even if I chose "" they would have issued a cert only good for "". – perrierism Jun 22 '10 at 19:13

A certificate for will not work for

There are plenty of tutorials.

share|improve this answer
Yes. So how do you make a seamless redirect from There is a way to do it, look at paypal or any other major https site. Do they have an extra certificate for to avoid the security warning? Also note, the tutorials you mention have nothing to do with the question asked. They are tutorials for generating ssl certificates. – perrierism Jun 22 '10 at 18:50
@perrierism: Paypal does indeed have a completely different Class 2 Certificate just for so it can be redirected. – Chris S Jun 22 '10 at 19:14
Also, and resolve to different IP addresses. So that means whatever box catches those requests only needs the certificate for that one domain. – Christopher Karel Jun 22 '10 at 19:43
Generating SSL certificates is a necessary part of the process. If you're lucky, your host will generate them for you. Yes, seamless redirects require extra certificates--ever get a browser warning that you are leaving a secured website? That's why. Chris S. agrees. – mcandre Jun 23 '10 at 15:00
Yes I think the final answer is that it requires 2 certificates. I was holding out that perhaps there was a DNS way of routing ""; calls to ""; to avoid the warning. Yes, of course I understand why you get a warning when you are leaving a secure site, but that's really different than what were talking about, if related. We're talking about redirecting to a secure site, and the certificate domains which are or aren't required for a secure host. – perrierism Jun 23 '10 at 18:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.