Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

For reasons much too long and complex to get into (it involves several layers of corporate red tape resulting in someone else not purchasing a wildcard SSL certificate I requested), I have to set up a domain to redirect all requests to – secure protocol with the www subdomain.

EDIT: The SSL certificate is only valid for the domain.

So:,, and should ALL redirect to

My .htaccess-fu is weak at best and I can't seem to get this to work. Note: hosting is on Media Temple if that makes a difference.

So far, my .htaccess file looks like so:

RewriteEngine On
RewriteCond %{HTTPS} !^on$
RewriteRule (.*)$1 [R,L]

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

Both and are redirecting to, so yay. However, is not redirecting to and is thus throwing a security warning page:

This is probably not the site you are looking for!
You attempted to reach, but instead you actually reached a server identifying itself as This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of
You should not proceed, especially if you have never seen this warning before for this site.

Any help in getting me past this one final hump would be muchly appreciated!

share|improve this question

5 Answers 5

up vote 7 down vote accepted

You need a certificate that is valid for both and if you're going to rewrite those requests to (or two separate certs that accomplish this). There's no way around this.

share|improve this answer
Drat, that's what I was afraid of. Probably easier/cheaper to just get a second cert for the non-www subdomain rather than a wildcard, then. Thanks! – Scottie Jul 14 '13 at 10:52
No problemo. Good luck! – MDMarra Jul 14 '13 at 10:55
Just as a note regarding the follow-up: This seems like a case where a SAN certificate seems more appropriate than a wildcard cert. In fact, many CAs seem to hand out SAN certs with both and more or less as a standard feature even for their cheapest certificates. – Håkan Lindqvist Jun 1 '14 at 18:09

This is a very complex question. Most tutorials on the internet will tell you, like Simbus82, to just invert some lines of code inside htacess. This will not always work (especially if you have an SSL offloading equipement in front of Apache)

You have a few options to solve the problem :

  • Use the, service. Risk of this solution : depending on a 3rd party. It works ONLY for HTTP requests redirect to HTTPS, so no help for redirecting to
  • Put a "URL" record in your DNS, if your registrar supports it
  • As MDMarra said, buy a wildcard (or multi domain) HTTPS certificate.

I can't explain why, but it looks like the SSL protocol checks the domain/subdomain certificate issue, before handling the request to Apache.

share|improve this answer
I think you may have missed the part about the warning being produced by the client rather than the server. Of course the client shouldn't trust redirects from a server with a certificate from a different domain than the client expected to see. I don't see how the service would help the slightest since it doesn't support HTTPS. (Which makes sense, because in order to support HTTPS that service would need to have a certificate valid for all domains.) – kasperd Sep 30 at 7:56
Right, kasperd, I got confused. The will work only for http requests redirect to https, which is part of the two domains Scottie succeeded to redirect. So it won't help (although it can be relevant for others). Editing my answer to make it clear – spiritoo Sep 30 at 10:07

@Simbus82 is right about inverting the rules. Here is an approach that is slightly more universal.

RewriteEngine On
# ensure www.
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ensure https
RewriteCond %{HTTP:X-Forwarded-Proto} !https 
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
share|improve this answer

My .htaccess knowledge is weak as well, but what about an alternate solution?

Can you redirect all to and have a button there they can click on? Explain on the page what you are doing.

Could you even make that a timed redirect in JavaScript or something?

share|improve this answer

Invert the rules ;-)

i'm using this and i had your problem

RewriteEngine On

RewriteCond %{HTTP_HOST} ^ [NC]
RewriteRule (.*)$1 [L,R=301]

RewriteCond %{SERVER_PORT} ^443$ [OR]
RewriteCond %{HTTPS} =on 
RewriteRule ^(.*)$$1 [R=301,L]

First rewrite to www and then check https.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.