Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a client who has a PHP website hosted by Apache. The website is for internal use only, but they still want their employees to be able to access it from their phones and home computers. The client is concerned about security and wanted the whole website to use https instead of http, so they bought an SSL certificate. Right now, http://example.com/ forwards to https://example.com/ . http://www.example.com/ also forwards to https://example.com/ . Both of these forwards are correct. However, https://www.example.com/ does not forward to the non-www version, which is incorrect. Not only that, but it displays the "Red Hat Enterprise Linux Test Page"! I don't know a whole lot about SSL certificates, but from what I've read, it sounds like I'll need another SSL certificate for the www version of the URL even though all I'll be doing is forwarding it to the non-www version of the URL. Does that sound right? What do you recommend I do in this situation?

This is what my virtual host configuration looks like (only with the correct IP address and hostname, of course):

<VirtualHost *:80>
    ServerAdmin admin@example.com
    ServerName example.com
    ServerAlias www.example.com

    Redirect permanent / https://example.com/
</VirtualHost>

<VirtualHost 1.2.3.4:443>
    ServerAdmin admin@example.com
    DocumentRoot "/var/www/example.com/public"
    ServerName example.com
    ServerAlias www.example.com

    <Directory /var/www/example.com/public>
        Options All
        AllowOverride All

        SSLRequireSSL
        SSLOptions +StrictRequire
        SSLRequire %{HTTP_HOST} eq "example.com"
    </Directory>

    ErrorLog /var/log/httpd/example.com-error.log
    LogLevel warn
    CustomLog /var/log/httpd/example.com-access.log combined
    ServerSignature Off

    SSLEngine on
    SSLCertificateFile /etc/httpd/certificates/example.com/example.com.crt
    SSLCertificateKeyFile /etc/httpd/certificates/example.com/example.key
    SSLCertificateChainFile /etc/httpd/certificates/example.com/gd_bundle.crt
</VirtualHost>
share|improve this question

1 Answer 1

Most chep SSL certs these days support the domain with and without www. You should check with the company your client purchased the cert from to make sure it was set up for this.

However, if that were the only problem, you'd see an SSL warning, not the default page, when visiting https://www.example.com/

SSL does not play well with VirtualHosts. Are there other sites hosted on the machine? If not, can the VirtualHosts and set up everything under the default.

share|improve this answer
    
There are other sites hosted on the machine –  Nick Apr 19 '12 at 17:03
    
Then you need to add a dedicated IP address for this one domain, and change the DNS to point to it. Or -- if this is the only domain that supports SSL, you could move its config to the default, and make sure you have VirtualHosts set up for all other domains. –  xofer Apr 19 '12 at 17:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.