Do I need an SSL certificate if all traffic is being redirected to another secure domain?

Question

I currently use a CNAME to silently direct all traffic for http://cdn.domain.com to my Rackspace Cloud Files domain at http://cxxx.rxx.cxx.rackcdn.com.

Now I also want to silently direct all HTTPS traffic for https://cdn.domain.com to https://cxxx.ssl.cxx.rackcdn.com.

I assume I can't do this using CNAME (if I can, bloody excellent!) so I'll be using VirtualHosts, as such:

<VirtualHost *:80>
    ServerName cdn.domain.com
    RewriteEngine On
    RewriteRule ^(.*)$ http://cxxx.rxx.cxx.rackcdn.com [L,R=301]
</VirtualHost>

<VirtualHost *:443>
    ServerName cdn.domain.com
    RewriteEngine On
    RewriteRule ^(.*)$ https://cxxx.ssl.cxx.rackcdn.com [L,R=301]
</VirtualHost>

Will I need an SSL certificate for the second vhost, or will it "borrow" it from Rackspace's HTTPS domian?

Answer 1

You will need a certificate for cdn.domain.com.

You can't use a CNAME because when the browser gets the cert for cxxx.ssl.cxx.rackcdn.com instead of cdn.domain.com, it'll throw up an error because the cert doesn't match the URL you put in. And when doing a redirect within apache, the redirection is happening after the SSL session is established (and the cert is needed to establish that SSL session).

Another solution would be to provide an alt name in the certificate for cxxx.ssl.cxx.rackcdn.com. Basically the cert would contain both cxxx.ssl.cxx.rackcdn.com and cdn.domain.com. You then could use a CNAME since the same cert is valid for both host names (URLs).

Answer 2

You will need one for your subdomain, as all that subdomain does is to redirect visitors.

I am pretty sure you can't do this with CNAME.

Another way to do it, is to redirect data from the HTTP connection to the HTTPS rackcdn connection like this:

<VirtualHost *:80>
    ServerName cdn.domain.com
    RewriteEngine On
    RewriteRule ^(.*)$ https://cxxx.rxx.cxx.rackcdn.com [L,R=301]
</VirtualHost>