Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had to switch servers and I want to redirect all SSL urls to the non-ssl site. The problem I am running into is the https site still throws invalid certificate error even through apache has the redirect implemented.

<VirtualHost *:443>
    ServerAdmin webmaster@dummy-host2.example.com
    DocumentRoot /data/sites/www.example.com/main/
    RewriteEngine on
    Redirect 301 / http://www.example.com

    SSLEngine on
    SSLCertificateFile    /etc/httpd/ssl/www.examplecom/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/httpd/ssl/www.example.com/ssl-cert-snakeoil.key

    ServerName www.example.com
    ErrorLog "logs/example.com-error_log"
    CustomLog "logs/example.com-access_log" common
</VirtualHost>

My question is, how can I do a redirect and avoid the invalid ssl certifcation error in the browser?

share|improve this question
    
The root domain is still the same example.com - when you say a different server do you mean a different physical box (and different URL) example.com -> newexample.com –  Jeremy Hajek Jun 27 '13 at 15:31
    
Domain domain, different physical box. Basically I want to get rid of all ssl –  Devin Dixon Jun 27 '13 at 15:40
    
Are you actually using ssl-cert-snakeoil.pem and ssl-cert-snakeoil.key in your vhost or have you changed those names for this question? –  Ladadadada Jun 27 '13 at 19:28

2 Answers 2

A proper SSL certificate (containing all required DNS names, and issued by a CA which is directly or indirectly trusted by clients' browsers) and the corresponding private key is required to get a secure connection without browser warnings. The fact that you are just redirecting to a non-SSL site does not matter — the browser must verify that it connected to the correct server before even sending the HTTP request.

If you had a valid certificate previously, but lost the private key during the server migration, you will need to contact the CA to revoke the old certificate and reissue a new certificate for the same domain.

share|improve this answer

You can't. The SSL certificate validation happens in the vicinity of the session layer. The HTTP conversation happens at the application layer.

I would suggest that you get a free SSL certificate that matches the host name, if your business type qualifies for that type of certificate. There are many CAs that offer free certificates.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.