Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a webserver that has an ssl certificate applied to a subdomain https://shop.mydomain.com. I also have the hostname http://mydomain.com that has no ssl certificate. When invoking https://mydomain.com, browsers issue a warning that a certificate could not be verified because the webserver is identifying itself as https://shop.mydomain.com.

I would like all traffic that hits https://mydomain.com to be redirected to http://mydomain.com, and leave https://shop.mydomain.com as is.

My httpd.conf file generally looks like this:

< VirtualHost 122.11.11.21:80 >
ServerName shop.mydomain.com
.. regular old port 80 ..
< /VirtualHost >

< VirtualHost 122.11.11.21:443 >
ServerName shop.mydomain.com
.. SSL applies here ..
< /VirtualHost >

< VirtualHost 122.11.11.21:80 >
ServerName mydomain.com
.. regular old port 80 ..
< /VirtualHost >

It does not look as if I have SSL set up for https://mydomain.com yet one can invoke SSL mode and the browser identifies the connection as https://shop.mydomain.com. I need to redirect from https://mydomain.com because for some reason, Google has indexed my website with this url even though it shows a warning.

I have tried various methods to get this to redirect and nothing has worked.

Any help would be greatly appreciated.

share|improve this question
add comment

1 Answer

This is a generic version of the rules I use.

    RewriteEngine On
    RewriteCond %{HTTP_HOST}   !^www\.example\.com [NC]
    RewriteRule ^/(.*)      https://www.example.com/$1 [L,R=301]

This will permanently redirect all requests not matching the canonical name to the the canonical name. Include it in the virtualhost definition for your SSL (HTTPS site).

The following rule set should force any non-HTTPS traffic to HTTPS.

    RewriteEngine On
    RewriteCond %{HTTPS} !=on [NC]
    RewriteCond %{HTTP_HOST}   ^www\.example\.com [NC]
    RewriteRule ^/(.*)      https://www.example.com/$1 [L,R=301]

EDIT: To test the redirection you will need to accept the certificate error. You should then end up on the desired site. This is what your clients will see until you get Google to reindex your site. Logon to the Google Webmaster Tools site and resubmit your sitemap. This should result in your site being crawled fairly soon. I don't know how fast the links on the search pages will be updated. If you haven't already registered your site, you will need to add specified content on the site to prove you have control of the site. There is information on setting the preferred site name as well.

share|improve this answer
    
I have tried the first rule and placed it in the https (122.11.11.21:443) section of httpd.conf, restarted httpd and still no go. When I visit https://mydomain.com it doesn't redirect to http://mydomain.com. It still shows the "This is probably not the site you are looking for!" message in Chrome. It seems as if the rule you provided redirects from http to https, which is the opposite of what I need. –  webnothing Oct 25 '13 at 1:37
    
@webnothing: That message comes before the server could have a chance to redirect you to http. To get any redirect, the https request first has to be replied by the server (the redirect comes to your browser in the reply). But for the https request to even reach the server, the SSL connection first has to be established. Before the SSL connection would be ready to transfer the first request, that annoying message will be presented by your browser. So, it's not possible to avoid that message by any rewrite-magic. –  Laszlo Valko Oct 25 '13 at 1:49
    
The solution to your problem would be to either have a different IP address (and different cert) for each of your different names, or to use only a single name, or to use a wildcard (*.domain) cert, or to use the SNI feature in your cert to list multiple names in a single cert. –  Laszlo Valko Oct 25 '13 at 1:53
    
Thanks Laszlo Valko!! I had a feeling that what I was doing was not getting executed before the warning message in the browser. I might try the SNI solution as then I wouldn't need to get another ip address and certificate. –  webnothing Oct 25 '13 at 2:03
    
I've edited my answer to provide information on working with the Google WebMaster tools. –  BillThor Oct 25 '13 at 2:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.