0

My site has a ssl certificate installed for a virtual host in my apache setup. It redirects http to https and https://sitename.com works but for some reason when the user explicitly types the www, "https://www.sitename.com", I get an invalid certificate error.

http://www.sitename.com works but once you use https, it all breaks.

This is part of my apache configuration for the virtual host

<VirtualHost *:80>
ServerName sitename.com
RedirectMatch permanent ^/(.*)$ https://sitename.com/$1
</VirtualHost>

<VirtualHost *:80>
ServerName catch-all.sitename.com
ServerAlias *.sitename.com
RedirectMatch permanent ^/(.*)$ https://sitename.com/$1
</VirtualHost>

<VirtualHost *:443>
ServerName sitename.com
Header always set Strict-Transport-Security max-age=31536000
SSLProxyEngine on
  • Look at the subject alternative name(s) on the certificate. – Michael Hampton Nov 14 '16 at 16:47
0

httpd doesn't know what the hostname in the host header is until the decryption process takes place, so if the original request doesn't match the hostname in the certificate, you will get an error.

If you want to have both domains work with https, you will need either:

  1. 2 x ip addresses with 2 individual certs, with each one attached to an ip address

  2. A wildcard certificate that works with both domains

A wildcard is the best option, but I'm guessing you didn't buy one of these, and that you have a cert that is specific to "sitename.com"

  • Or, Option 3: SNI – Mark Henderson Nov 14 '16 at 16:52
  • Still going to require another cert, so may as well just get the wildcard. – Garreth McDaid Nov 14 '16 at 16:54
  • Is there a way to just redirect https://www requests to https:// only? Or is does it not know the hostname at that point? – Austin Nov 14 '16 at 16:56
  • You'ld still need a certificate valid for both names, or 2 IPs. – SYN Nov 14 '16 at 17:09
  • No, you can't do that. As per answer, the only hostname the server knows upon the initial request is the hostname requested in the GET. It can't act upon anything in the host headers until after decryption has taken place. – Garreth McDaid Nov 14 '16 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.