Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A client has an SSL certificate only for the www.site.com version of the domain, not site.com.

Redirecting for regular HTTP was not a problem via mod_rewrite.

However, this method seemed to fail for us for HTTPS.

We want to redirect https://site.com requests to https://www.site.com.

Can this be done without raising an invalid certificate warning in the browser, or getting a wildcard certificate?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

No, it doesn't work that way.

The SSL transaction happens before any HTTP is sent, so the SSL warning will appear before any redirect can happen.

Actually, I don't believe a wildcard would work, either, since site.com and *.site.com are not the same. You may want to consider Subject Alternative Names on the certificate.

share|improve this answer
    
I was afraid this was the case. Thank you for confirming it. –  djdy Mar 8 '12 at 22:41
    
This answer is incorrect. See serverfault.com/a/367843/113375 –  Ben Lessani - Sonassi Sep 19 '12 at 23:26

RapidSSL's Basic Certificate when purchased under

www.mydomain.com 

also covers

domain.com

Whilst not wildcard, it does give you cover for the TLD and www subdomain.

Yes, you can redirect from a subdomain to another without an SSL error - we use this on many, many sites, just one example is:

https://www.theclientarea.info which redirects to https://sms-sagat.theclientarea.info

Without error.

A simple .htaccess rewrite will take care of it for you:

RewriteEngine On
RewriteCond %{ENV:HTTPS} !On [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

RewriteCond %{HTTP_HOST} !^www\.mydomain\.com$ [NC]
RewriteRule ^(.*)$ http://www.mydomain.com/$1 [R=301,L]

Any type of movement between HTTPS subdomains will work without error or prompt, be it POST/GET/.htaccess redirect

The only time it becomes an issue, is if you are redirecting from HTTPS to HTTP - then it will prompt you.

--

@cjc - You are incorrect.

share|improve this answer
    
Right, you're using Subject Alternative Names in the certificate. The OP is going to need a new cert. –  cjc Mar 9 '12 at 0:21
    
No, we're using 2 separate certs. But I was just saying that the cheapest SSL cert on the market does what he needs (support for TLD with/without www subdomain). –  Ben Lessani - Sonassi Mar 12 '12 at 0:01

protected by Sven Apr 30 at 10:31

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.