Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've had problems in the past with old DNS entries (belonging to other people) pointing to a server. To prevent the server responding and making those hostnames appear to hold exact copies of my content, I use NameVirtualHost and make the default virtual host always respond 503 forbidden. That seems to work nicely.

Now, though, I'm wondering how best to achieve the same thing with SSL.

Obviously, if a client were to request a page over HTTPS while using an unrecognised hostname, they would get SSL warnings because the certificate wouldn't match. However, they have the option of bypassing those warnings. I'd like to prevent the server from serving the content even if the client chooses to ignore the SSL warning.

It seems I can't use the same NameVirtualHost trick, since name-based virtual hosts with SSL requires SNI, which has potential compatibility issues with old clients that I would rather avoid. Instead, I have to use an IP-based virtual host. SSLRequireSSL doesn't seem to help - it's happy regardless of whether the certificate worked.

Google is an example of this, though presumably not using apache. If you edit your /etc/hosts and point some random name at a google IP address, when you visit it via SSL you first get a warning, but then if you continue anyway you get a 503 error - "Service error -27. That’s all we know".

I'm not sure this really matters all that much. The apparent duplicate site resulting from the stray DNS entry before was actually causing our content to appear in search engines under the wrong domain name. In this case, presumably (hopefully!) the search engine won't index the content if the SSL certificate is invalid.

Nonetheless, I'd like to do this right if there is a standard approach.

share|improve this question
up vote 3 down vote accepted

What about just redirect clients from wrong domain name to your domain? Apache's mod_rewrite can help to solve this problem like this:

RewriteEngine On
RewriteCond %{HTTP_HOST} !
RewriteRule ^/(.*)$$1 [R=301]

With this configuration all clients will be redirected to right domain name after ignoring SSL warning. Also, search bots will index your content with suitable domain name.

share|improve this answer
Ah yes, at the time I considered doing that for the non-SSL case, but (not for any particular reason) chose to return an error instead. That is a clear benefit for the redirect solution - it works with SSL, too :-) – Tom Apr 1 '13 at 20:03
If you still want to return an error, try RewriteRule .* - [R=503] ;) – kubus Apr 1 '13 at 20:35
Nice! Didn't know you could do that. Thanks! – Tom Apr 1 '13 at 20:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.