Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking to redirect https://sub.domain.com to https://sub.otherdomain.com without changing the user's address bar.

Is this even technically possible? I can imagine some certificate issues?

We are using Apache on linux by the way.

Thanks!

-

Some background info;

We are launching a web application that resellers can offer to their clients, preferably "located" on their own domain name, but hosted by us. So when clients go to app.reseller.com they are actually using app.ourcompany.com. This is to minimize the risk of code leakage and keep the executing of updates and fixes completely under our own control.

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Patching your app to use window.history.pushstate.
Have you clients run a webserver at app.clientdomain.tld that serves an iframe of your site.
Hope that your client's users are using compatible browsers (and have javascript enabled).

That said, Christopher Evans first idea (rerouting at the DNS level) is best if you can. (Go with CNAMEs so your clients can fire and forget.) However, as no entity should be able to receive a valid certificate for another, multidomain certs will not help unless a single client has more than one domain. Your clients will have to generate a valid certs and hand over both the certs and associated keys to you. (The keys should be passed securely.)

Or you could wait for http://www.ietf.org/rfc/rfc2817.txt (Don't! This is true, but not useful).

Edit:

An option which doesn't cost IP addresses (at least until you run out of easily accessible ports) is to have your webserver serve each client cert on an alternate port rather than an alternate IP address. e.g. clients link https://app.client.tld:7703/
You'll still have to do the DNS stuff.

share|improve this answer
    
Thank you very much for elaborating on Christopher's first idea. Very useful, this. Patching app isn't an option since that might break it on certain browsers. –  Maurice Oct 7 '11 at 8:03
    
Thought of a small tweak which may make this more workable for you. –  84104 Oct 7 '11 at 15:12
    
@user84101 - your edit is basically what I was trying to describe in my answer. I think having a iFrame is a bad way to go because of browser domain permissions and cross-site scripting things you have to work around. –  djangofan Oct 7 '11 at 20:30

If you don't want to change the address bar, then you either have to use an HTML frame, or you need to setup your server as a proxy. So that requests that reach https://sub.domain.com are proxied to https://sub.otherdomain.com

You cannot perform an HTTP redirect without the address bar changing.

share|improve this answer

There is a slight possibility you could get something to work but you would have to start with a wildcard certificate that supports both domain names.

One way you might do this is to have a front facing Apache proxy that serves a wildcard certificate with multiple connectors and uses mod-proxy. In that configuration, client can switch between domains and not incur a "validate this certificate" error.

Then, the front facing proxy server would intelligently forward requests to a back-end http-only server (such as a tomcat instance), using mod-proxy, mod-ajp, and/or mod-rewrite, where the backend server runs on a different port for each server site. Your mod-rewrite rules can handle all the details of choosing how to route.

share|improve this answer
    
Can Tomcat even do this to another server? It would be no problem for the browser to see sub.domain.com while the ssl certificate is for sub.otherdomain.com? –  Maurice Oct 6 '11 at 18:22
    
Sorry about all the editing of my answer. I was a crazy dog on this one. –  djangofan Oct 6 '11 at 18:41
    
No worries, thanks for participating so actively!! –  Maurice Oct 7 '11 at 7:58

1) You can have the DNS point sub.domain.com to an ip address/server you control. You would then have the ssl certificate for sub.domain.com installed there. 2) If you are limited on ip addresses, you can get Multi Domain Certs. Go Daddy limits you to 99 domains, and it might be a complex shuffle for each domain you add. 3) You can also have the client get the ssl certificate, and have to act as a proxy connecting to your site.

share|improve this answer
    
How does getting a multi-domain certificate permit him to redirect from site A to site B without modifying the address bar? –  Zoredache Oct 6 '11 at 18:38
1  
I believe Mod-proxy could swap between back end servers while the address bar remains the same if you used another instance of Apache as a proxy. –  djangofan Oct 6 '11 at 18:42
    
It wouldn't be redirecting. This would allow him to have sub.domain.com be hosted on the same ip address of sub.otherdomain.com. Its options to implement besides the ones you listed which are also valid ways to do it ( my option 3 seems to be like your option 2 ) –  becomingwisest Oct 6 '11 at 19:48
    
Thank you very much, it would seem your option #1 would be the way to go since it's a solution on DNS level. I will see how far we can get with this. –  Maurice Oct 7 '11 at 8:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.