Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We had a certificate issued by Verisign and have allowed it to expire as we no longer have need for it.

Clients who have bookmarked the website with a 'https://' URL are greeted with a 'certificate has expired' warning. Some of our documentation may also reference the defunct URL.

Is there someway we can dispense with this warning? Ideally, we would like to simply redirect them to the plain 'http://' version of the website.

share|improve this question

The expired certificate warning is purely client-side, so the only you can make the client browsers happy is to present them with a certificate that they like. There's nothing you can do other than put up a certificate that's valid, otherwise the clients are going to present error messages. Even if you put up a redirect, the browser is going to expect to negotiate SSL before receiving the redirect (and will show the user an error message if you're presenting an invalid certificate).

This is the protocol working by-design. One could argue that the protocol should've been designed to allow for a "This resource doesn't need SSL anymore" mode for exactly the situation you're describing, but it wasn't.

share|improve this answer
Replacement is the key. As a side note ou don't really need to replace it with an expensive cert. You can go with the really cheap certs (e.g. godaddy). – Zoredache Dec 9 '09 at 1:05

Although the real answer is that you must have a valid cert as mentioned already, an alternative is to not have a redirect and disable ssl on the server for that ip. This way you would get the browser's standard site not found error rather than one about a bad certificate. It would still be an error, but a more useful one in some circumstances.

share|improve this answer

I agree with Evan Andersons answer but there is a way around it.

You can create your own self signed cert using java keytool to create a new Apache/Tomcat keystore. It's difficult but it would work. The user would be presented with a cert that is from an unknown source (you) but you can just import the cert and trust it. Then, from that point forward, you wouldn't be presented with the invalid cert based on a expired date.

share|improve this answer

Is there a reason to not renew the cert?

You might not want the customer to use the https site, but as you said they still are.

You can get a cheap ssl cert from GoDaddy for less than $50.

There are others even cheaper options.

share|improve this answer

Like Evan Anderson wrote, your users will probably still get a warning in their browser. On Apache the redirect should look something like this:

Options +FollowSymlinks
RewriteEngine on
RewriteCond %{SERVER_PORT} ^443$
RewriteRule ^(.*)$$1 [R=301,L]
share|improve this answer
There's no "might" about it. They're going to get certificate warnings if they're accessing an HTTPS URL hosted by a web server that presents an invalid certificate. The redirect happens after SSL comes up, so they'll get warned. – Evan Anderson Dec 8 '09 at 23:50
I didn't mean to sound like I was mitigating the possibility of that result, it was an agreement with what you said. My post was intended for his need to redirect to http://, presumably so the users only get the certificate warning on the first page load. Based on the downvotes I misunderstood what he needed. – Pablo Dec 9 '09 at 21:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.