Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite
1

Scenario:

I have 2 domains: thinkingmonkey.me & thinkingmonkey.com. Whole of the site is accessed under https. Bought a certificate from a CA with common name thinkingmonkey.me.

For http:

  • www.thinkingmonkey.com, thinkingmonkey.com & www.thinkingmonkey.me have a single virtual host and get redirected to https://thinkingmonkey.me using _mod_rewrite_ rules.

  • thinkingmonkey.me has its separate virtualhost.

  • Everything works fine.

Same is the case for https:

  • i.e. www.thinkingmonkey.com, thinkingmonkey.com & www.thinkingmonkey.com have a single virtual host and get redirected to https://thinkingmonkey.me using _mod_rewrite_ rules.

  • thinkingmonkey.me has its separate virtualhost.

The Problem

  • Now, if https://www.thinkingmonkey.com or https://thinkingmonkey.com is accessed,
    • mod_ssl acts and a TLS Handshake occurs before mod_rewrite does the rewrite to https://thinkingmonkey.me.
    • Since the common name in the certificate is under thinkingmonkey.me, This Connection is Untrusted warning get show at the browser.
    • Unless I complete the handshake by accepting the certificate, It will not get redirected to thinkingmonkey.me. Which is very annoying.

So,
Is there a way to access mod_rewrite before mod_ssl?
or
Do I have to buy a separate certificate to get rid of this?

share|improve this question
You shouldn't double post here and on StackOverflow and then delete your question there when there are answers (although here would have been the correct place to ask in the first place anyway). – Bruno Feb 16 '12 at 20:49
@Bruno I am well aware of the norm. Actually, I hadn't noticed the answer. I was on the page & had not refreshed it. Pardon though. – ThinkingMonkey Feb 16 '12 at 20:52

2 Answers

up vote 5 down vote accepted

No, HTTPS is HTTP over TLS/SSL (see RFC 2818), which first establishes the SSL/TLS connection before any HTTP traffic is sent. mod_rewrite will always apply after the SSL/TLS connection is established.

Not doing so would actually be a security issue, since an attacker could rewrite and redirect the client before the certificate has been verified. Even if the TLS upgrade was within HTTP (RFC 2817, which is virtually never used/supported and is not https), you would still want the redirection to come from a trusted entity.

The way around this is to use a certificate with multiple Subject Alternative Name (SAN) DNS entries, one for each host name, or multiple certificates (in which case you may need one IP address per certificate too, unless you're willing to use Server Name Indication).

share|improve this answer
Thanks for the info. – ThinkingMonkey Feb 16 '12 at 20:53
up vote 2 down vote

No, there is no way to do this. Consider getting a SAN certificate that includes both names. If you get 2 certs, you will need 2 IP addresses.

share|improve this answer
Thanks for the information. – ThinkingMonkey Feb 16 '12 at 20:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.