Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a SSL certificate which is registered for I didn't register and I don't have money to do that.

Since the SSL exchange is done before the actual site is loaded, I can't simple put a redirect in .htacess without the client getting a SSL-warning. Is there anyway I can make sure that all are redirected to before the SSL exchange? Maybe something directly on the Apache server or something in the DNS?

share|improve this question

migrated from Nov 9 '12 at 19:51

This question came from our site for professional and enthusiast programmers.

DNS is only resolving ip addresses and domains. That won't help you. – Roger Nov 9 '12 at 14:41
I didn't register and I don't have money to do that. - Um, why would that cost you extra? You own, just make an A record for it and get a certificate that has both names. – MDMarra Nov 9 '12 at 19:53
up vote 9 down vote accepted

Host name verification is a client-side mechanism (as described in the HTTPS specification, RFC 2818, Section 3.1). The client will check that the certificate is valid for the host name it has requested before any HTTP traffic happens (in particular, before any redirection). Apache redirections or DNS changes won't be of any use.

You simply need the web server to present a certificate that is valid for the requested host name.

Some certificates can be valid for multiple host names, by having multiple Subject Alternative Name (SAN) DNS entries, e.g. and Some CAs do this by default, some do it for an extra fee.

(Wildcard certificates can also be used to handle multiple host names provided they follow the right pattern such as * Unfortunately, isn't matched by * because the dot is part of the pattern. Some wildcard certs will have both a SAN for and *, in which case it's the SAN mechanism that will be used for, nothing to do with the wildcard.)

You could also use Server Name Indication (SNI) and have an additional, different certificate on that host for (next to the one for Unfortunately, it's not supported by certain clients (possibly old, but they still exist), and it would certainly be pointless, since most CAs issuing a cert for would certainly include automatically in another SAN anyway.

Either way, if you want to be able to serve at all (even if it's just for a redirection), you'll have to get a new certificate valid for it (at least).

share|improve this answer
I'd add that many of the Cert vendors offer one or more Subject Alternative Names for free on their middle tier and higher products. And most allow at least one re-issue where you can add a second name. Check your current cert vendor to see if you can double-up for free. – Mark Nov 9 '12 at 20:08
@Bruno - It would be good if the answer were updated to note the technical features that support the use of hostnames such as www and domains without hostnames -… – Motivated Apr 22 at 6:21
@Motivated Not sure what you mean. I've clearly mentioned this "Some certificates can be valid for multiple host names, by having multiple Subject Alternative Name (SAN) DNS entries, e.g. and Some CAs do this by default, some do it for an extra fee." – Bruno Apr 22 at 9:41
@Bruno - The article at suggests that there is a technical feature that supports this. Is this different to Subject Alternative Names? – Motivated Apr 23 at 6:21
@Motivated No, it's not different, they do call it SAN in their article too. – Bruno Apr 23 at 11:06

The only option to solve your problem without having to buy a second certificate is buying a wild-card certificate for *

But I assume that such certificates are a bit more expensive that a standard certificate and you already have one for your domain therefore I don't see a way to get what you want without spending again money.

BTW: Even buying a second certificate wont' solve all your troubles as I assume you have only one public IP address and therefore you would have to use "Server Name Indication" (SNI) which is not supported in IE on XP.

share|improve this answer
Actually, the * wildcard won't help at all for since the dot isn't part of the pattern matched. What's needed is a cert with multiple SANs: and Some CAs do this by default. Wildcards certs tend to work for this because they're often issued with SANs for and *, but it's not the wildcard that's used for this. In addition, there's no need for a second cert and SNI if the new cert is valid for both hosts. – Bruno Nov 9 '12 at 15:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.