This question already has an answer here:

I am having the following issue, trying to set up the SSL certificate. When opening the root domain name example.com the browser shows the green sign and all is fine. However trying to open with www version www.example.com I see the following message

www.example.com uses an invalid security certificate.

The certificate is only valid for example.com

(Error code: ssl_error_bad_cert_domain)

From this message I am guessing that the SSL was issued for example.com only (please correct me if Im wrong), now except buying another certificate, that would include both versions, is there another way to avoid that warning, namely kind of to redirect all traffic to example.com before even "showing" to the browser the certificate ? So, when the user types https://www.example.com it would redirect to https://example.com, where the certificate is already valid.

I have this in my site file

<VirtualHost *:80>
        ServerName example.com
        ServerAlias www.example.com
        Redirect / https://example.com/

<VirtualHost *:443>
        ServerName example.com
        ServerAlias www.example.com
        DocumentRoot /home/username/www/example

        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/example.com.crt
        SSLCertificateKeyFile /etc/apache2/ssl/example.com.private.key
        SSLCertificateChainFile /etc/apache2/ssl/example.com.intermediate.crt

I tried to put a redirect condition inside VH, however it did not help.

RewriteCond %{HTTP_HOST} ^www.example.com
RewriteRule ^/(.*)$ https://example.com/$1 [L,R=301]

Apache 2.2.22, Debian 7.9


marked as duplicate by Jenny D, mdpc, Community Jan 4 '16 at 14:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    Have the certificate reissued. They should have added www.example.com to it to begin with. – Michael Hampton Jan 2 '16 at 21:40
  • If there were such a way, that would be a huge security hole. A person who punches https://www.domain.com/ into their browser should either get something that can prove it's www.domain.com or it should get a security error. they should definitely not get some other site without a warning. – David Schwartz Jan 2 '16 at 23:51

No. The TLS protocol (and its obsolete predecessor, SSL) validates the certificate according to the host part of the URL, in this case the complete domain name, before any data is transferred. This is by design, and fulfils several security requirements.

You should get a certificate (it's not called "an SSL") issued for both your domain names; the feature used to do this is called subjectAlternativeName or SAN. Sometimes you can also get a wildcard certificate that includes both *.example.com and example.com.


First off, most certificates should come with www already. I haven't heard of one that only is issued for the root domain. TLS actually checks the entire URL, not just the root domain, so a certificate for the root, without WWW, will be invalid if used on a WWW domain. Wildcard and EV certificates also exist, but those are much more expensive.

As to SSL certificates, have you considered using Let's Encrypt instead of buying the certificate outright? Let's Encrypt allows you to issue multiple certificates for any number of subdomains (up to 100) for free.

  • 1
    Hopefully nobody is issuing certificates for TLDs, since that refers to like com. – Falcon Momot Jan 2 '16 at 22:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.