Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For reasons much too long and complex to get into (it involves several layers of corporate red tape resulting in someone else not purchasing a wildcard SSL certificate I requested), I have to set up a domain to redirect all requests to https://www.example.com – secure protocol with the www subdomain.

EDIT: The SSL certificate is only valid for the www.xyz.com domain.

So: http://example.com, http://www.example.com, and https://example.com should ALL redirect to https://www.example.com.

My .htaccess-fu is weak at best and I can't seem to get this to work. Note: hosting is on Media Temple if that makes a difference.

So far, my .htaccess file looks like so:

RewriteEngine On
RewriteCond %{HTTPS} !^on$
RewriteRule (.*) https://www.example.com/$1 [R,L]

RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

Both http://example.com and http://www.example.com are redirecting to https://www.example.com, so yay. However, https://example.com is not redirecting to https://www.example.com and is thus throwing a security warning page:

This is probably not the site you are looking for!
You attempted to reach example.com, but instead you actually reached a server identifying itself as www.example.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of example.com.
You should not proceed, especially if you have never seen this warning before for this site.

Any help in getting me past this one final hump would be muchly appreciated!

share|improve this question
up vote 7 down vote accepted

You need a certificate that is valid for both example.com and www.example.com if you're going to rewrite those requests to www.example.com (or two separate certs that accomplish this). There's no way around this.

share|improve this answer
    
Drat, that's what I was afraid of. Probably easier/cheaper to just get a second cert for the non-www subdomain rather than a wildcard, then. Thanks! – Scottie Jul 14 '13 at 10:52
    
No problemo. Good luck! – MDMarra Jul 14 '13 at 10:55
    
Just as a note regarding the follow-up: This seems like a case where a SAN certificate seems more appropriate than a wildcard cert. In fact, many CAs seem to hand out SAN certs with both www.example.com and example.com more or less as a standard feature even for their cheapest certificates. – Håkan Lindqvist Jun 1 '14 at 18:09

Invert the rules ;-)

i'm using this and i had your problem

RewriteEngine On

RewriteCond %{HTTP_HOST} ^site.it [NC]
RewriteRule (.*) http://www.site.it/$1 [L,R=301]

RewriteCond %{SERVER_PORT} ^443$ [OR]
RewriteCond %{HTTPS} =on 
RewriteRule ^(.*)$ http://www.site.it/$1 [R=301,L]

First rewrite to www and then check https.

share|improve this answer

This is a very complex question. Most tutorials on the internet will tell you, like Simbus82, to just invert some lines of code inside htacess. This will not always work (especially if you have an SSL offloading equipement in front of Apache)

You have a few options to solve the problem :

  • Use the http://redirect.name, service. Risk of this solution : depending on a 3rd party. It works ONLY for HTTP requests redirect to HTTPS, so no help for redirecting https://example.com to https://www.example.com
  • Put a "URL" record in your DNS, if your registrar supports it
  • As MDMarra said, buy a wildcard (or multi domain) HTTPS certificate.

I can't explain why, but it looks like the SSL protocol checks the domain/subdomain certificate issue, before handling the request to Apache.

share|improve this answer
    
I think you may have missed the part about the warning being produced by the client rather than the server. Of course the client shouldn't trust redirects from a server with a certificate from a different domain than the client expected to see. I don't see how the redirect.name service would help the slightest since it doesn't support HTTPS. (Which makes sense, because in order to support HTTPS that service would need to have a certificate valid for all domains.) – kasperd Sep 30 '15 at 7:56
    
Right, kasperd, I got confused. The redirect.name will work only for http requests redirect to https, which is part of the two domains Scottie succeeded to redirect. So it won't help (although it can be relevant for others). Editing my answer to make it clear – spiritoo Sep 30 '15 at 10:07

@Simbus82 is right about inverting the rules. Here is an approach that is slightly more universal.

RewriteEngine On
# ensure www.
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# ensure https
RewriteCond %{HTTP:X-Forwarded-Proto} !https 
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
share|improve this answer

My .htaccess knowledge is weak as well, but what about an alternate solution?

Can you redirect all http://example.com to http://example.com/redirect.html and have a button there they can click on? Explain on the page what you are doing.

Could you even make that a timed redirect in JavaScript or something?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.