Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a domain that I run with SSL. I purchased a certificate for Note that it does not apply to at all and I think that might be where my issue lies. My goal is that my visitors arrive at, without a www. There are four cases to cover:

 1. - Redirected in namecheap to
 2. - Redirected by server code
 3. - No redirect necessary
 4. - The problem case, read below

In that case last my www redirect does not seem to be working at all. I'm not sure why that is. Do I need to buy a second cert for www? Is there a way to setup my DNS to get it to simply redirect? I don't care to have my users come in on www at all, but I do need to redirect those people that manually type in the www address.

My host record is setup as follows:

Host  Redirect to             Record type
@          A (Address)
www   URL Redirect (301)
share|improve this question
up vote 0 down vote accepted

Think about how this is happening.

The client requests It attempts to initiate the TLS session with the web server. It sees that there is no valid cert for that domain. It errors out before any redirect can happen.

You're going to need to either add a SAN to the additional cert for, or you'll need another single-name cert for

share|improve this answer
Was afraid you'd say that, but I wanted confirmation before dropping money on a second cert. Might have to try it. – JPRO May 19 '13 at 0:09
I have a client that uses a multi-domain certificate for this purpose. Depending on the vendor, once you get more than 4-5 domains, the multi-domain can save money and is easier to manage. – jeffatrackaid May 20 '13 at 17:56

Some certificate authorities provide what's called a wildcard certificate. I think you're looking for the features provided by that.

For example on the digicert website you can see this type of certificate:

I believe this is what MDMarra was also referring to. Wildcard certificates make use of SANs ( Subject Alternative Names).

There's an explanation of SANs here on the digicert site as well:

share|improve this answer
There's no need for a wildcard cert for this. They're way more costly than getting a normal cert with a single SAN. This this case, the common name would be and the single SAN would be If he really only needs and then a wildcard is a waste of money. – MDMarra May 19 '13 at 1:19
Not only that, but * doesn't match (though many wildcard certs have an SAN added to them). – DerfK May 19 '13 at 1:53
My experience has been that the * has the SAN added. I wasn't aware that that might not always be the case. – slm May 19 '13 at 2:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.