Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I have 2 domains: & Whole of the site is accessed under https. Bought a certificate from a CA with common name

For http:

  •, & have a single virtual host and get redirected to using _mod_rewrite_ rules.

  • has its separate virtualhost.

  • Everything works fine.

Same is the case for https:

  • i.e., & have a single virtual host and get redirected to using _mod_rewrite_ rules.

  • has its separate virtualhost.

The Problem

  • Now, if or is accessed,
    • mod_ssl acts and a TLS Handshake occurs before mod_rewrite does the rewrite to
    • Since the common name in the certificate is under, This Connection is Untrusted warning get show at the browser.
    • Unless I complete the handshake by accepting the certificate, It will not get redirected to Which is very annoying.

Is there a way to access mod_rewrite before mod_ssl?
Do I have to buy a separate certificate to get rid of this?

share|improve this question
You shouldn't double post here and on StackOverflow and then delete your question there when there are answers (although here would have been the correct place to ask in the first place anyway). – Bruno Feb 16 '12 at 20:49
@Bruno I am well aware of the norm. Actually, I hadn't noticed the answer. I was on the page & had not refreshed it. Pardon though. – ThinkingMonkey Feb 16 '12 at 20:52
up vote 7 down vote accepted

No, HTTPS is HTTP over TLS/SSL (see RFC 2818), which first establishes the SSL/TLS connection before any HTTP traffic is sent. mod_rewrite will always apply after the SSL/TLS connection is established.

Not doing so would actually be a security issue, since an attacker could rewrite and redirect the client before the certificate has been verified. Even if the TLS upgrade was within HTTP (RFC 2817, which is virtually never used/supported and is not https), you would still want the redirection to come from a trusted entity.

The way around this is to use a certificate with multiple Subject Alternative Name (SAN) DNS entries, one for each host name, or multiple certificates (in which case you may need one IP address per certificate too, unless you're willing to use Server Name Indication).

share|improve this answer
Thanks for the info. – ThinkingMonkey Feb 16 '12 at 20:53

No, there is no way to do this. Consider getting a SAN certificate that includes both names. If you get 2 certs, you will need 2 IP addresses.

share|improve this answer
Thanks for the information. – ThinkingMonkey Feb 16 '12 at 20:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.