Redirecting subdomain from http to external https but avoiding redirect alert

Question

I am using a hosted wiki service which runs over SSL, I have a CNAME redirect from my subdomain to it but browsers show a message saying it is being redirected.

Is there a way I can get around this? My host and the hosted site's tech are disagreeing on what to do (basically each is saying the other needs to do something)

The current set up is:

http://wiki.mydomain.org --> https://mydomain.externalhost.org

Any and all suggestions would be very much appreciated :)

edit

The server that my domain on is running Apache, I'm not sure about the external hosts (sorry I'm not so clued up technically as to versions etc)

Within my DNS panel it states: This CNAME record will point wiki.appsforgood.org to appsforgood.onconfluence.com.

I should explain I proposed installing a SSL cert on the wiki sub-domain but my hosts said this wouldn't stop the error message and it should installed at the external hosts server. Of course the external hosts say it needs to be installed on the wiki sub-domain leaving me banging my head on the table trying to get a definitive answer

Answer 1

You are using a CNAME. The problem is that the SSL Certificate is issued for the domain name you're CNAME is pointing to.

To explain where the "problem" is:

1. Someone types into their browser wiki.example.com.
2. The browser gets the IP address of that domain name (jumping through the CNAME, but the browser knows nothing of the CNAME, DNS does this behind the scenes, the browser just gets the IP back) and connects.
3. The browser and server it connects to start the SSL negotiation process. The SSL Certificates says "Hi, I'm example.externalhost.com"
4. The browser see that the server is using a different name than what the user typed in. Throws warning.

What you want is a server to pickup the wiki.example.com and do a Redirect (CNAMEs are NOT redirects). The redirecting server would say "Hi, I'm wiki.example.com; you need to go connect to example.externalhost.com". A browser would see the initial matching name, so no warning, then proceed to connect to the new host (which would also match the name, so no warning).