0

I have a valid SSL certificate for myapp.com, but not for www.myapp.com. Based on this question, it seems to me that it's not possible to immediately redirect from https://www.myapp.com to https://myapp.com without getting another certificate for www.myapp.com.

I'm trying to avoid shelling out more money for another certificate that's only going to be used to redirect to the "correct" site, but I also want to avoid big security warnings when somebody inadvertently accesses the wrong version.

Is it possible to use a self-signed certificate or anything free to get somebody redirected to the right version without buying another certificate?

Improve this question
5
  • 3
    Most certificate authorities will include the www subdomain for free. StartSSL will give you a certificate for free. Try asking yours and if they say no, ask StartSSL.
    – Ladadadada
    Mar 5, 2014 at 7:39
  • @Ladadadada I went with RapidSSL because I had heard they were pretty solid. I don't see anything in there about including additional subdomains, unfortunately.
    – aardvarkk
    Mar 5, 2014 at 7:45
  • you could have bought a wildcard certificate..
    – neutrinus
    Mar 5, 2014 at 9:22
  • 2
    I think you should have bought the certificate for www.myapp.com, then you would have received a certificate for both myapp.com and www.myapp.com. A wildcard certificate is not necessary.
    – Tero Kilkanen
    Mar 5, 2014 at 9:29
  • @TeroKilkanen I believe this is the "correct" response. Since I purchased the certificate recently, I was able to cancel it. I will re-enroll with www.myapp.com and that should also cover myapp.com. I will verify that that's in fact the case, but if you'd like you may submit an answer with this content and I'll give you credit for it.
    – aardvarkk
    Mar 5, 2014 at 15:31

2 Answers 2

Reset to default
5

I think you should have bought the certificate for www.myapp.com, then you would have received a certificate for both myapp.com and www.myapp.com. A wildcard certificate is not necessary.

Improve this answer
1
  • Yep, this was it! After cancelling my purchase and buying a certificate for www.myapp.com, everything works as expected. Not something they make very obvious when you're buying the thing! Thanks for the great answer!
    – aardvarkk
    Mar 7, 2014 at 0:48
0

No, it is not possible. HTTPS is HTTP inside SSL, so to get the HTTP redirect first the SSL connection has to be established and verified - and this is the steps where it fails if you don't use a certificate not trusted by the browser (e.g. self-signed or where the hostname does not match the certificate).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .