The encryption will still take place, but the users won't be in a position to check that it's done with the right party, which is essential to ensure the security of the communication.
Indeed, the purpose of the certificate verification (RFC 5280/3280) and host name verification (RFC 2818 Section 3.1 and RFC 6125) is to make sure that you're communicating with the right party. Otherwise, you could still be communicating using encryption, but with a party you didn't intend to talk to (e.g. a MITM attacker).
What's failing here is the host name verification, if you have a valid certificate.
The easiest solution is to get a certificate with two Subject Alternative Names (SAN), one for www.website.com
and one for website.com
. This will make that certificate valid for both hosts at the same time.
A number of CAs do this as part of their normal service (with and without the www.
), sometimes for free, sometimes for an extra fee.