Since the SSL exchange is done before the actual site is loaded, I can't simple put a redirect in .htacess without the client getting a SSL-warning. Is there anyway I can make sure that all https://domain.com are redirected to https://www.domain.com before the SSL exchange? Maybe something directly on the Apache server or something in the DNS?
migrated from stackoverflow.com Nov 9 '12 at 19:51
Host name verification is a client-side mechanism (as described in the HTTPS specification, RFC 2818, Section 3.1). The client will check that the certificate is valid for the host name it has requested before any HTTP traffic happens (in particular, before any redirection). Apache redirections or DNS changes won't be of any use.
You simply need the web server to present a certificate that is valid for the requested host name.
Some certificates can be valid for multiple host names, by having multiple Subject Alternative Name (SAN) DNS entries, e.g.
(Wildcard certificates can also be used to handle multiple host names provided they follow the right pattern such as
You could also use Server Name Indication (SNI) and have an additional, different certificate on that host for
Either way, if you want to be able to serve
But I assume that such certificates are a bit more expensive that a standard certificate and you already have one for your domain therefore I don't see a way to get what you want without spending again money.
BTW: Even buying a second certificate wont' solve all your troubles as I assume you have only one public IP address and therefore you would have to use "Server Name Indication" (SNI) which is not supported in IE on XP.