10

A client has an SSL certificate only for the www.site.com version of the domain, not site.com.

Redirecting for regular HTTP was not a problem via mod_rewrite.

However, this method seemed to fail for us for HTTPS.

We want to redirect https://site.com requests to https://www.site.com.

Can this be done without raising an invalid certificate warning in the browser, or getting a wildcard certificate?

Improve this question

2 Answers 2

Reset to default
10

No, it doesn't work that way.

The SSL transaction happens before any HTTP is sent, so the SSL warning will appear before any redirect can happen.

Actually, I don't believe a wildcard would work, either, since site.com and *.site.com are not the same. You may want to consider Subject Alternative Names on the certificate.

Improve this answer
4
  • I was afraid this was the case. Thank you for confirming it.
    – djdy
    Mar 8, 2012 at 22:41
  • 1
    This answer is incorrect. See serverfault.com/a/367843/113375
    – Ben Lessani
    Sep 19, 2012 at 23:26
  • @BenLessani-Sonassi The linked answer does not seem to cover how you can have a redirect occur when the certificate for the original site is not recognized by the browser.
    – Michael
    Oct 5, 2017 at 16:59
  • The point I was trying to make is that almost all CA's will provide a certificate that covers both the apex domain and www subdomain when purchased under the www subdomain variant.
    – Ben Lessani
    May 12, 2018 at 23:51
0

RapidSSL's Basic Certificate when purchased under 

www.mydomain.com

also covers 

domain.com

Whilst not wildcard, it does give you cover for the TLD and www subdomain.

Yes, you can redirect from a subdomain to another without an SSL error - we use this on many, many sites, just one example is:

https://www.theclientarea.info which redirects to https://sms-sagat.theclientarea.info

Without error.

A simple .htaccess rewrite will take care of it for you:

RewriteEngine On
RewriteCond %{ENV:HTTPS} !On [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]

Any type of movement between HTTPS subdomains will work without error or prompt, be it POST/GET/.htaccess redirect

The only time it becomes an issue, is if you are redirecting from HTTPS to HTTP - then it will prompt you.

Improve this answer
2
  • Right, you're using Subject Alternative Names in the certificate. The OP is going to need a new cert.
    – cjc
    Mar 9, 2012 at 0:21
  • No, we're using 2 separate certs. But I was just saying that the cheapest SSL cert on the market does what he needs (support for TLD with/without www subdomain).
    – Ben Lessani
    Mar 12, 2012 at 0:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .