My setup is as follows:

  • 100+ websites
  • Each website has two host headers any.com and www.any.com
  • Requests for www.any.com are redirected to any.com without changing protocol
  • Some of these websites need SSL
  • Requests for http://sslonly.com are redirected to https://sslonly.com
  • I have a multiple domain (a.k.a. UCC/SAN) SSL certificate that allows up to 50 subject alternative names

My questions:

  1. What is the best way to set up subject alternative names on the SSL certificate? Do I need to add both sslonly.com and www.sslonly.com or just sslonly.com?

  2. What is the best way to set up the redirects?

I am using IIS 8.5

  • Most non-SAN vendors automatically add the www variant, but I haven't encountered one that does it for SAN certs. I'd always include both variants, as you'll find plenty of people type in both ways. – ceejayoz Sep 27 '18 at 14:01

Yes, you should add all names that are used for redirects. That is, if you connect to https://example.com and this site redirects to https://www.example.com and it is the same web site, then your certificate must include both, example.com and www.example.com in the Subject Alternative Names extension. If any redirect host part is not listed in the certificate, redirect will fail and stop at this point with certificate error in browser.

  • actually it would be the other way round (www to no-www). Does this matter. – Salman A Sep 27 '18 at 14:01
  • 1
    No, it doesn't matter. What matters: each redirect host part must be included in SAN extension of the certificate. The order is irrelevant. – Crypt32 Sep 27 '18 at 14:05
  • It's possible to also use a wildcard like *.domain.com but that can open up security issues. It's better to include domain.com and www.domain.com if that's all you're using. – duct_tape_coder Sep 27 '18 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.