Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to redirect without a rewrite rule from eg https://www.domain.com to https://www.domain.net . I have a wildcard certificate for *.domain.net . This yields the following warning in my error_log

[warn] RSA server certificate wildcard CommonName (CN) `*.domain.net' does NOT match server name!?

This makes sense and I understand why the warning. I would like to ask if there is a way to use the Redirect directive to accomplish the above without the warnings. Here is my virtual hosts in ssl.conf:

<VirtualHost *:443>
    SSLEngine on
    ServerName www.domain.net
    DocumentRoot /var/www/html/domain

    SSLOptions -FakeBasicAuth -ExportCertData +StrictRequire +OptRenegotiate -StdEnvVars
    SSLStrictSNIVHostCheck off
</VirtualHost>

<VirtualHost *:443>
    SSLEngine on
    ServerName www.domain.com
    ServerAlias www.domain.info
    Redirect permanent / https://www.domain.net
</VirtualHost>

Also, if there is a solution, can it be used for redirection from htps://domain.com to htps://www.domain.com? Thanks a lot!

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Please be aware that the SSL handshake and verification process of the underlying HTTPS connection occurs before the actual request is sent. That means no HTTP response from the server before the authenticity of the server certificate has been verified, not even redirects.

If you only have one endpoint (ie. only 1 public IP address), you'll need to buy a SAN certificate, that is, a certificate with Subject Alternative Names.

That way you could have a wildcard certificate for *.domain.net with the SAN www.domain.com, and you won't get any certificate warnings

For further info, check out an old answer I gave for a similar situation, just with nginx instead of apache

share|improve this answer

www.domain.com (and for that matter www.domain.info) are not the same domain as www.domain.net, hence the warning. You should have certificates for those domains as well, if you need to avoid this warning.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.