0

I have a valid SSL certificate for myapp.com, but not for www.myapp.com. Based on this question, it seems to me that it's not possible to immediately redirect from https://www.myapp.com to https://myapp.com without getting another certificate for www.myapp.com.

I'm trying to avoid shelling out more money for another certificate that's only going to be used to redirect to the "correct" site, but I also want to avoid big security warnings when somebody inadvertently accesses the wrong version.

Is it possible to use a self-signed certificate or anything free to get somebody redirected to the right version without buying another certificate?

  • 3
    Most certificate authorities will include the www subdomain for free. StartSSL will give you a certificate for free. Try asking yours and if they say no, ask StartSSL. – Ladadadada Mar 5 '14 at 7:39
  • @Ladadadada I went with RapidSSL because I had heard they were pretty solid. I don't see anything in there about including additional subdomains, unfortunately. – aardvarkk Mar 5 '14 at 7:45
  • you could have bought a wildcard certificate.. – neutrinus Mar 5 '14 at 9:22
  • 2
    I think you should have bought the certificate for www.myapp.com, then you would have received a certificate for both myapp.com and www.myapp.com. A wildcard certificate is not necessary. – Tero Kilkanen Mar 5 '14 at 9:29
  • @TeroKilkanen I believe this is the "correct" response. Since I purchased the certificate recently, I was able to cancel it. I will re-enroll with www.myapp.com and that should also cover myapp.com. I will verify that that's in fact the case, but if you'd like you may submit an answer with this content and I'll give you credit for it. – aardvarkk Mar 5 '14 at 15:31
5

I think you should have bought the certificate for www.myapp.com, then you would have received a certificate for both myapp.com and www.myapp.com. A wildcard certificate is not necessary.

| improve this answer | |
  • Yep, this was it! After cancelling my purchase and buying a certificate for www.myapp.com, everything works as expected. Not something they make very obvious when you're buying the thing! Thanks for the great answer! – aardvarkk Mar 7 '14 at 0:48
0

No, it is not possible. HTTPS is HTTP inside SSL, so to get the HTTP redirect first the SSL connection has to be established and verified - and this is the steps where it fails if you don't use a certificate not trusted by the browser (e.g. self-signed or where the hostname does not match the certificate).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.