Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For reasons much too long and complex to get into (it involves several layers of corporate red tape resulting in someone else not purchasing a wildcard SSL certificate I requested), I have to set up a domain to redirect all requests to https://www.example.com – secure protocol with the www subdomain.

EDIT: The SSL certificate is only valid for the www.xyz.com domain.

So: http://example.com, http://www.example.com, and https://example.com should ALL redirect to https://www.example.com.

My .htaccess-fu is weak at best and I can't seem to get this to work. Note: hosting is on Media Temple if that makes a difference.

So far, my .htaccess file looks like so:

RewriteEngine On
RewriteCond %{HTTPS} !^on$
RewriteRule (.*) https://www.example.com/$1 [R,L]

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

Both http://example.com and http://www.example.com are redirecting to https://www.example.com, so yay. However, https://example.com is not redirecting to https://www.example.com and is thus throwing a security warning page:

This is probably not the site you are looking for!
You attempted to reach example.com, but instead you actually reached a server identifying itself as www.example.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of example.com.
You should not proceed, especially if you have never seen this warning before for this site.

Any help in getting me past this one final hump would be muchly appreciated!

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You need a certificate that is valid for both example.com and www.example.com if you're going to rewrite those requests to www.example.com (or two separate certs that accomplish this). There's no way around this.

share|improve this answer
    
Drat, that's what I was afraid of. Probably easier/cheaper to just get a second cert for the non-www subdomain rather than a wildcard, then. Thanks! –  Scottie Jul 14 '13 at 10:52
    
No problemo. Good luck! –  MDMarra Jul 14 '13 at 10:55
    
Just as a note regarding the follow-up: This seems like a case where a SAN certificate seems more appropriate than a wildcard cert. In fact, many CAs seem to hand out SAN certs with both www.example.com and example.com more or less as a standard feature even for their cheapest certificates. –  Håkan Lindqvist Jun 1 at 18:09

My .htaccess knowledge is weak as well, but what about an alternate solution?

Can you redirect all http://example.com to http://example.com/redirect.html and have a button there they can click on? Explain on the page what you are doing.

Could you even make that a timed redirect in JavaScript or something?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.