Just been setting up HSTS on an Apache vHost (it is a virtualmin box) and have that working, however I am experiencing strange behavior when trying to force a call to https www rather than it redirecting to the https non www.

If I call the http www version then HSTS does its job just fine and gives me the HTTPS, non www site. However manually calling HTTPS WWW throws me a certificate error stating the name on the cert does not match the calling URL.... which I know is because I don't have www on the cert.

I have tried the usual 301 redirect in the vhost but I can still get to https www. rather than being redirected to https non www.

Any ideas folks?


  • The SSL handshake is done before the client gets the redirect. If you want a redirect on https you need a certificate for all involved domains. There is no way around it. – Gerald Schneider Dec 3 '18 at 11:50
  • Fix the certificate. It should have all relevant names. – Michael Hampton Dec 3 '18 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.