.htaccess redirect from SSL root domain to another subdomain with different SSL causes NET::ERR_CERT_COMMON_NAME_INVALID

Question

I need help to figure this out.

1. I have two local, separate webservers 192.168.11.5 (https://www.example.com) and 192.168.9.14 (https://project.example.com). Each has separate non-wildcard SSL installed from positivieSSL
2. I have one public static, and created A entry for both to point to this static IP
3. The firewall routing will route all http requests to https://www.example.com (192.168.11.5); and will route all http port 90 to https://project.example.com (192.168.9.14)
4. All routing to both webservers are working fine (using default port for www and port 90 for https://project.example.com:90)

But when users just type project.mydomain.com without the port, firewall will route this service to https://www.example.com which is the default for port 80 (default http port). I added this .htaccess in the root of www.example.com to redirect the request for project.example.com to https with port 90.

    <IfModule mod_rewrite.c>
    # Use https for www, dont match project subdomain
            RewriteCond %{HTTPS} off [OR]
            RewriteCond %{HTTP_HOST} !^www\. [NC]
            RewriteCond %{HTTP_HOST} !^project\. [NC]
            RewriteCond %{HTTP_HOST} ^(.*)$  [NC]
            RewriteRule (.*) https://www.example.com/$1 [R=301,L]
    
    # Rewrite project.example.com (if no port specified) to port 90
    
            RewriteCond %{HTTP_HOST} ^project\. [NC]
            RewriteRule (.*) https://project.example.com:90/$1 [L,R=301]
    
    </IfModule>

The redirect works but with this notice (and user have to ignore the notice in order to get redirected):

NET::ERR_CERT_COMMON_NAME_INVALID
This server could not prove that it is project.example.com; its security certificate is from www.example.com.
This may be caused by a misconfiguration or an attacker intercepting your connection.

Proceed to project.example.com (unsafe)

Thanks in advance for any suggestions to get rid of this certificate error msg above.

Answer 1

Add a (ssl) virtual host to 192.168.11.5 for https://project.example.com that redirects to https://project.example.com:90 (note https is on 443 so most expect 8443 as the alt port rather than 90) You will need to add the SSL cert to 192.168.11.5 so it can answer traffic to redirect traffic to the other host.

You If you're terminating SSL traffic on 192.168.11.5 you could proxy it over to 192.168.9.14