Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have multiple IP's on one server and for each IP I have a SSL website configured. This is working fine.

However I server a number of non-SSL sites on the primary IP. The problem occurs when a user tries to visit the https version of one of these non-https websites. They are presented with the certificate for the main SSL website and then if they accept it they are forwarded to the https website.

What would be the best way to deal with this? I have tried to set up an apache default ssl host to catch these other requests but it doesn't seem to work. Maybe some redirect logic to forward requests not for the default ssl domain to the non https versions of the requested site? Any ideas are appreciated.

share|improve this question
up vote 1 down vote accepted

The SSL handshake happens before the HTTP, so the redirect logic will not be invoked before the user is presented with an SSL warning in the browser.

The only way to keep that warning from happening is to have a certificate that presents with the servernames used by those vhosts, using, say, Subject Alternate Name, or Server Name Indication. This way, the SSL handshake happens without issue, and you can redirect after that. But, whatever you do, you will need a valid certificate for those non-SSL sites.

The other way is to get another IP address for the non-SSL sites, and vhost on that. Basically, you need to separate the non-SSL sites from the SSL sites. That way, a user won't be accidentally going to the SSL vhost and seeing the browser warning. On the other hand, the user will just get a timeout, as the SSL port is not available for the non-SSL site.

A third way is to not care about people going to the SSL host if they're trying to get to a non-SSL site. This is perhaps the cheapest and least effort option, but it may not be available to you.

share|improve this answer
Careful about SNI though. Windows XP does not support it and there are still many users on XP. – Frands Hansen Jan 7 '13 at 13:38
Ok thanks. I think the separate IP will have to be the solution. – b3n Jan 8 '13 at 21:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.