Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a couple of https only sites on our server, these have redirects set up to send any http request to the https address. However we have an issue where our http only site addresses accessed over https are showing a certificate error (rightly as the certificate doesn't belong to that address) and then going to a 403.2 error (http://support.microsoft.com/kb/247677). I have managed to stop the http only sites accessed over https redirecting to one of the https only sites, but the certificate error is still an issue.

Is it possible to fix this?

share|improve this question
    
Can you explain what it would mean to "fix" the problem? What would you like to happen if someone tries to access using https a site for which you have no appropriate certificate, other than an error being produced explaining that you have no certificate? What would it do if it was "fixed" exactly? Your circumstances are such that it can't work, because you have no appropriate certificate, and it is producing an error precisely describing the problem, that there's no appropriate certificate. In what sense does this require fixing? And what would you prefer happen? –  David Schwartz Mar 8 '13 at 14:58
    
I guess the issue from our client's point of view is that a reference to a site certificate that isn't theirs is appearing on a URL that is like their live URL. https://<domain-name>.co.uk rather than http://<domain-name>.co.uk gives a certificate error with A N Other company's name all over it. So the "fix" would be to have the https URL not trigger the error or go to some kind of generic "not found" page. –  chrishey Mar 8 '13 at 16:40
    
You can't go to a generic "not found" page because you can't prove the page wasn't found. Without a certificate belonging to the host the client is asking about, how can you prove you are the site and therefore have the authority to say what pages are or aren't found? So the fix you are seeking is impossible in principle. If another fix isn't acceptable, then you are trying to do something that is, by design, not possible to do. If you want the connection not to work at all, you'll have to use a different IP address with nothing listening on the https port. –  David Schwartz Mar 8 '13 at 16:45
    
Ok thanks, like i put in my original question "is it possible to fix this?". I have explored some solutions and tried a few things and got as far as i could, so threw it open to find out if i am wasting time trying to fix the impossible. –  chrishey Mar 8 '13 at 16:57

1 Answer 1

This error message precisely describes the actual error. You basically have two choices:

  1. Put sites that aren't supposed to be accessed by HTTPS on a different public IP address that has nothing listening on the default HTTPS port.

  2. Get a certificate that includes every site you host on this IP address so that the client doesn't get a certificate error and serve that certificate.

Otherwise, the client will, should, and must get a certificate error.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.