Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Apache 2.2 server and a wildcard SSL certificate for * and have set up a mod_rewrite ruleset for both 80 and 443 that will properly redirect requests for to

RewriteCond %{HTTP_HOST} ^
RewriteRule ^(.*)$$1 [R=permanent,L]

(that's the one for 443; the one on 80 just omits the 's' in 'https').

That part is working properly for both http and https - it does the rewrite - but it doesn't quite solve the issue that I wanted fixed. Specifically, when someone goes to, they'll get a certificate warning because the wildcard certificate for * doesn't match just If they choose to accept the certificate and continue, the rewrite goes properly and the normal lock icon replaces the angry lock icon. The problem is that they get the warning in the first place - they have to choose to ignore the certificate warning before the rewrite is done. Is there a proper way to send traffic to over to before attempting to do the SSL negotiation? It looks like mod_rewrite is doing it after the fact.

share|improve this question
up vote 2 down vote accepted

SSL negotiation always happens before HTTP request is started, there is no way to avoid that.

The only way to fix this problem is to get a new certificate that has both and * listed.

share|improve this answer
Strictly speaking separate certificates for and * would work as well, the important point is that without a valid certificate for this error is supposed to occur. (A single SAN certificate with both names, as suggested in the answer, would be preferable.) – Håkan Lindqvist Jun 23 '14 at 18:05

As Tero already pointed out, SSL negotiation happens before mod_rewrite kicks in. This means that the only way for you to solve this, is to get a certificate that is also valid for

Because Apache supports SNI, it can present a different certificate for a different hostname, so you may just get yourself a cheap or free additional certificate at a company like StartSSL.

However, in my experience, people rarely type https:// in their address bar, so if you just make sure that is redirected directly to, there is no problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.