0

MY GOAL

I would like to make a website accessible only via SSL (encrypted) and with many domains redirecting to only one master domain (no duplicate content) and all www variants should be no-www.

The website is hosted by an apache server and configured as a virtual host.

I would like to have the redirections like follows:

http://example.com -> https://example.com

http://www.example.com -> https://example.com

https://www.example.com -> https://example.com

http://example.de -> https://example.com

http://www.example.de -> https://example.com

https://example.de -> https://example.com

https://www.example.de -> https://example.com

[...]

THE ERROR / PROBLEM

My problem is that certain requests (like https://www.example.de) are redirected to https://example.com but e.g. firefox says the connection is not secure (SSL_ERROR_BAD_CERT_DOMAIN). Some others work.

My vhost config looks like this:

<VirtualHost *:80>
  ServerName www.example.com
  ServerAlias example.com www.example.de example.de
  RedirectMatch 301 (.*) https://example.com$1
</VirtualHost>

<VirtualHost *:443>
  ServerName www.example.com
  ServerAlias www.example.de example.de
  RedirectMatch 301 (.*) https://example.com$1
</VirtualHost>

<VirtualHost *:443>
  ServerName example.com
  ServerAdmin webmaster@example.com
  DocumentRoot /var/www/example
  <Directory "/var/www/example">
    AllowOverride All
    AuthType Basic
    AuthName "Example.com Temporary Preview"
    AuthUserFile /var/www/users
    Require user example-dev
  </Directory>

  Include /etc/letsencrypt/options-ssl-apache.conf
  SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>

I am using certbot for verfifying the domains and obtaining the ssl-certificate from letsencrypt like this:

sudo certbot --authenticator webroot --installer apache certonly

then selecting all the domains (which the apache installer guesses perfectly), specifying the webroot for the authentication process in the interactiv cli installer.

(Before the certbot process I use another vhost config for that domain, using only Port 80 to let the authentication process work)

MY QUESTION / MISCONCEPTION

I understand my apache vhost configuration like this:

  • catch all http requests (all domains, with and without www) and redirect them to https://example.com

  • catch all https requests (all domains except example.com, with and without www and redirect them to https://example.com

  • finally catch https requests for example.com and serve the DocumentRoot with all the config as told in that third VirtualHost Block.


  1. Why is the browser complaining in some cases, that the certificate is not valid for the given domain?

  2. Is there a better/easier way to achieve what I want? Am I misunderstanding concepts of Apache-Redirections in that circumstance (SSL, no-www, letsencrypt)? Am I missing some part while using the certbot command?

2

Are you obtaining certificate for example.de? Even if you are doing a 301 redirect, browser first requests SSL for the domain which is redirected to another domain example: https://www.example.de is redirected to https://example.com.

So domain (https://www.example.de) must also have a valid SSL as it is requested first by browser. This would not be a case if you redirect non SSL http://www.example.de to https://example.com.

So make sure you issue SSL certificate for all SSL domains. Test those domains without redirection, and then implement your redirections.

  • I am pretty sure, that I requested ALL possible domains for the certificate. Also I thought about missing one, but it is really not working mainly when I request httpS:// explicitly in the browser's address bar. So I guess, it might be a problem with my apache-vhost config. Like it is ignoring the second block or something?? – Edgar Alloro Nov 12 '18 at 10:34
  • BTW, i did not find a command on certbot's documentation that lists all domains for a certain certificate. Is there a way to find that out? – Edgar Alloro Nov 12 '18 at 10:35
  • Thank you! By investigating further what you said, and my suspicion that there is something wrong with the second VirtualHost-Block in my config, it turned out that I had to add those three lines Include /etc/letsencrypt/options-ssl-apache.conf SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem to that second block also. – Edgar Alloro Nov 13 '18 at 22:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.