Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had to switch servers and I want to redirect all SSL urls to the non-ssl site. The problem I am running into is the https site still throws invalid certificate error even through apache has the redirect implemented.

<VirtualHost *:443>
    DocumentRoot /data/sites/
    RewriteEngine on
    Redirect 301 /

    SSLEngine on
    SSLCertificateFile    /etc/httpd/ssl/www.examplecom/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/httpd/ssl/

    ErrorLog "logs/"
    CustomLog "logs/" common

My question is, how can I do a redirect and avoid the invalid ssl certifcation error in the browser?

share|improve this question
The root domain is still the same - when you say a different server do you mean a different physical box (and different URL) -> – Jeremy Hajek Jun 27 '13 at 15:31
Domain domain, different physical box. Basically I want to get rid of all ssl – Devin Dixon Jun 27 '13 at 15:40
Are you actually using ssl-cert-snakeoil.pem and ssl-cert-snakeoil.key in your vhost or have you changed those names for this question? – Ladadadada Jun 27 '13 at 19:28

A proper SSL certificate (containing all required DNS names, and issued by a CA which is directly or indirectly trusted by clients' browsers) and the corresponding private key is required to get a secure connection without browser warnings. The fact that you are just redirecting to a non-SSL site does not matter — the browser must verify that it connected to the correct server before even sending the HTTP request.

If you had a valid certificate previously, but lost the private key during the server migration, you will need to contact the CA to revoke the old certificate and reissue a new certificate for the same domain.

share|improve this answer

You can't. The SSL certificate validation happens in the vicinity of the session layer. The HTTP conversation happens at the application layer.

I would suggest that you get a free SSL certificate that matches the host name, if your business type qualifies for that type of certificate. There are many CAs that offer free certificates.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.