0

I have a client who has ssl on his www.website.com url but now the website.com url. So when they go to https://website.com/admin-login.php, they see an SSL error saying it doesn't belong to the domain. My client can skip this screen and proceed to the website anyway.

My question is, even though they skip this screen, will the SSL continue to encrypt/secure all relevant as if it were the www version of the website?

2 Answers 2

5

The encryption will still take place, but the users won't be in a position to check that it's done with the right party, which is essential to ensure the security of the communication.

Indeed, the purpose of the certificate verification (RFC 5280/3280) and host name verification (RFC 2818 Section 3.1 and RFC 6125) is to make sure that you're communicating with the right party. Otherwise, you could still be communicating using encryption, but with a party you didn't intend to talk to (e.g. a MITM attacker).

What's failing here is the host name verification, if you have a valid certificate.

The easiest solution is to get a certificate with two Subject Alternative Names (SAN), one for www.website.com and one for website.com. This will make that certificate valid for both hosts at the same time.

A number of CAs do this as part of their normal service (with and without the www.), sometimes for free, sometimes for an extra fee.

4

Yes, the connection is still SSL-encrypted. The warning is that the certificate used to generate the encryption doesn't belong to the website being visited. (So it could be a forgery, an indication of something malicious... or a website operator who didn't get an updated SSL certificate when he updated the site's url.)

For how cheap they are these days, your client should definitely buy a new SSL certificate for the new url, which will make that error go away.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .