Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We just switched domain names from to We have a number of short cuts on desktops to

I have setup Rewrite rules in both vhosts and the SSL vhost that if the domain is not to redirect to

The VirtualHost rewrite works flawlessly for non SSL requests. However, on the SSL pages users are given an invalid security certificate exception. The Rewrite rule seems to not take affect before this point. However, if they add an exception the Rewrite rule kicks in immediately and takes them to

It appears the Certificate exception is happening before the Redirect, which makes sense. Here is the SSL Virtual host redirect. The non SSL one is nearly identical.

<VirtualHost _default_:443>
     RewriteEngine On
     RewriteCond %{HTTP_HOST} !^www\.newdomain\.com$ [NC]
     RewriteRule ^{REQUEST_URI} [R=301,L]

I have read that HTTP_HOST is not a valid variable in SSL, but even removing that condition and having all requests redirected still produces the exception.

Is there anything we can do to have the redirect to the new domain, with the valid SSL certificate and subdomain/domain combo, before a browser certificate exception is displayed?

share|improve this question
up vote 3 down vote accepted

Given that the rewrite/redirect doesn't happen until after the user has made a request, it makes perfect sense that HTTPS requests to a site with the wrong SSL certificate provoke a browser warning.

The correct way to handle this is to have two separate SSL vhosts, on separate IPs, each configured with their own SSL certificate. Then, in the olddomain vhost, setup your redirects as you want them.

share|improve this answer

Because HTTPS negotiates security before the host: header, you either have to get a certificate that has both the old site and the new site, or you need to put your old site redirector on its own IP address. You could play games with ports but that would probably confuse your users.

share|improve this answer

Instead of having 2 separate IPs and 2 separate certificates, another option is to use a UC certificate to include both names in one certificate. Then you can redirect without receiving any errors.

share|improve this answer
Commonly known as a "wildcard" certificate. – djangofan Apr 26 '11 at 18:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.