1

I have a somehow specific setup. It really is due to some restrictions I cannot work around: There are domains 1. and 2. which I own and an external URL which I don't own:

  1. start.com
  2. root.com
  3. http://target.com/my/site?a=1

My goal is to redirect http://sub.start.com (and https://...) to http://target.com/my/site?a=1. Now to the restrictions:

  • For 1. I can change dns entries. However, I cannot change anything on the http server itself. Also, the current setup is such that every http request is redirected to https. I also cannot alter the SSL certificate, which is not a wildcard certificate
  • For 2. basically no restrictions. I can change everything on the server. (lighttpd) I can also get SSL certificates via Let's Encrypt.
  • For 3. As mentioned, this is an external URL I don't own. It will also redirect any http request to https

How to achieve my goal? This is what I've setup so far:

What works is the redirect http://sub.root.com to http://target.com/my/site?a=1. What doesnt work is:

  1. The redirect from https://sub.root.com to http://target.com/my/site?a=1 Returns a "insecure connection" message in firefox. This is because sub.root.com is not (yet) included in the SSL certificate. I can understand this issue. It is easy to fix.
  2. However, what I can't understand is that the redirect from http://sub.start.com does not work. This redirects me to https://sub.start.com and then complains that the certificate at root.com does not include sub.start.com. Why is this? I was expecting that the CNAME entry would "ignore" the server at start.com. The request should go directly to root.com, shouldn't it?

Also, is there a way to achieve my goal with this exact setup? I'm thinking to include sub.start.com and also sub.root.com to my SSL certificate at root.com. Would this take care of all the issues?

1 Answer 1

3

I was expecting that the CNAME entry would "ignore" the server at start.com. The request should go directly to root.com, shouldn't it?

False expectation, and discussed here over and over again: redirection is done on the HTTP protocol. Once resolved using CNAME and A DNS records the request goes directly to the IP address, unaware of what has happened on the DNS level. CNAME won't do HTTP redirection.

Then, the request contains the original hostname on the address bar as a HTTP 1.1 Host header

GET / HTTP/1.1
Host: sub.start.com

and the web server replies with the content configured for that virtualhost. This hostname and this hostname alone is also used when the browser compares the address with the SSL certificate. This comparison is done before the headers are sent and before any redirection occurs at all.

Having all the other hostnames configured as redirections to the canonical hostname at your web server configuration solves the redirection problem. Having all the hostnames as subject alternative names in your certificate solves the error messages your users are getting.

3
  • Thanks for the explanation. Actually, I was aware that CNAME does not do redirections. This is exactly why I am wondering about the certification error when trying "http:// sub.start.com" and the automatic redirect to "https: //sub.start.com" ! See my point 2. However, it seems that this has to do with a specific setting of start.com My browser tells me that because of HSTS the unencrypted connection is not supported. Thus, it seems that this unexpected behavior is due to the HSTS setting and nothing else. This is in line with my understanding.
    – mc51
    Nov 25, 2017 at 14:29
  • If your start.com has HSTS enabled with includeSubdomains, it'll cause a client side redirection to HTTPS. Nov 25, 2017 at 14:40
  • 1
    HSTS was forcing my browser to https://sub.start.com which was the cause for the unexpected behavior. I have fixed it by obtaining an ssl certificate for sub.start.com and putting it on my root.com http server. Also, I had to configure this server so that this new certificate is delivered whenever https://sub.start.com is in the Host value of the http request (as @Esa Jokinen explains)
    – mc51
    Nov 25, 2017 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .