Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website with an SSL cert. Let's say it's called , I have a rewrite rule set to redirect any request to to go to this works great.

But, every now and then I get someone who types and they get an SSL certificate mismatch. As the cert is only for

What's the best way to do the re-direct first, before the server throws the ssl certificate to the web browser?

share|improve this question

There is no way to do the redirect first, as the SSL connection must be in place before the HTTP connection (which contains any redirect) can occur.

Some certificate authorities will include as a Subject Alternate Name on a certificate for at no extra charge - that's probably the easiest solution; any other solution (SNI, a second IP for www) involves buying a second certificate anyway.

share|improve this answer
+1, but usually it's when you order for www.domain.tld they throw in domain.tld for free :) – Frands Hansen Jan 27 '12 at 22:31
@fbh Good point - current provider might even do it if the names are flipped around. – Shane Madden Jan 27 '12 at 22:33
makes sense, i was hoping i could undo that. i'll just order the right certs. – Vid Luther Jan 30 '12 at 5:07

The server is not the one throwing the exception. It's the browser that is throwing the exception. You need to get a cert that covers or a wildcard cert to cover this case.

What is happening is the client is requesting and since nginx is returning with the cert for it's throwing the error. The client is going to throw the cert mismatch error before any redirects you do at the server side.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.