Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a website with an SSL cert. Let's say it's called example.com , I have a rewrite rule set to redirect any request to http://example.com to go to https://example.com/ this works great.

But, every now and then I get someone who types https://www.example.com/ and they get an SSL certificate mismatch. As the cert is only for example.com.

What's the best way to do the re-direct first, before the server throws the ssl certificate to the web browser?

share|improve this question
add comment

2 Answers 2

There is no way to do the redirect first, as the SSL connection must be in place before the HTTP connection (which contains any redirect) can occur.

Some certificate authorities will include www.example.com as a Subject Alternate Name on a certificate for example.com at no extra charge - that's probably the easiest solution; any other solution (SNI, a second IP for www) involves buying a second certificate anyway.

share|improve this answer
    
+1, but usually it's when you order for www.domain.tld they throw in domain.tld for free :) –  Frands Hansen Jan 27 '12 at 22:31
    
@fbh Good point - current provider might even do it if the names are flipped around. –  Shane Madden Jan 27 '12 at 22:33
    
makes sense, i was hoping i could undo that. i'll just order the right certs. –  Vid Luther Jan 30 '12 at 5:07
add comment

The server is not the one throwing the exception. It's the browser that is throwing the exception. You need to get a cert that covers www.example.com or a wildcard cert to cover this case.

What is happening is the client is requesting https://www.example.com and since nginx is returning with the cert for example.com it's throwing the error. The client is going to throw the cert mismatch error before any redirects you do at the server side.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.