0

I have my site configured on apache and now I'm trying to set up re-directions correctly.

My site uses wildcard SSL certification and my ssl certificate covers *.mydomain.com. My certificate provider only covers one level subdomain. My site URL is https://level1.mydomain.com, but I want to redirect users that go to https://www.level1.mydomain.com to https://level1.mydomain.com. I setup the redirection from www.level1 to level1, but when I type https://www.level1.mydomain.com on my browser I get 

This server could not prove that it is www.level1.mydomain.com; its security certificate is from *.mydomain.com. This may be caused by a misconfiguration or an attacker intercepting your connection.

As I understand, the reason is that www.level1 is a level2 subdomain and my wildcard does not cover that.

What do I need to do? Buy another certificate for www.level1? If yes, how should I configure the virtualhost so both certificates point to the same DocumentRoot folder?

thank you.

Improve this question
3
  • Instead of using a redirect, you could purchase another certificate and use a second Apache virtualhost for www.level1.mydomain.com but pointing to the same DocumentRoot. You would need to be careful about how you reference your application internally , but it would certainly meet the criteria you stated.
    – Thomas N
    Nov 13, 2019 at 19:11
  • @ThomasN you would need SNI enabled for that to work. (I don't know offhand how/if that's handled in Apache's vHost configuration.)
    – Chris Davies
    Nov 19, 2019 at 0:09
  • 1
    @roaima The page you linked to says it all, I think; Apache server supports SNI since version 2.2.12. Since the current major version is 2.4.*, I'd think it would be pretty well defined.
    – Thomas N
    Nov 19, 2019 at 18:58

1 Answer 1

Reset to default
0

AFAIK if you just enter

www.level1.mydomain.com

into your browsers addressbar, you request the mydomain.com webserver on port 80 http protocol. For http you don't need a certificate.

if you enter

https://www.level1.mydomain.com

you ask on port 443 / https which needs a certificate.

If you enter

level1.mydomain.com

and only configured your webserver to work with https/443 you'll get an error message, webserver not listening to port 80 (502 bad gateway - or whatever).

You need to add redirects/rewrites for all domains/virtual hosts listening on port 80/http to https. This is easy - no certificates needed -

like so (untested)

<VirtualHost *:80>
   ServerName level1.mydomain.com       
   Redirect / https://level1.mydomain.com
</VirtualHost>

<VirtualHost *:80>
   ServerName  www.level1.mydomain.com
   Redirect / https://level1.mydomain.com
</VirtualHost>

For all users typing

https://www.level1.mydomain.com

You would need to buy an extra certificate or get a free letsencrypt.org certificate for this sub.sub.domain just for redirecting. Maybe not worth the trouble.

BTW adding a second virtual host pointing to the same DocumentRoot could work for plain HTML pages but not for applications. I would go with redirects.

Tutorial about redirects/rewrites
https://www.tecmint.com/redirect-http-to-https-on-apache/

About letsencrypt
https://letsencrypt.org/

Improve this answer
2
  • Thank You for your answer. It is much clear now. The reason I asked is that we are using the Rank Math SEO plugin and his site analysis complains that "The www and non-www versions of your URL are not redirected to the same site." so, to do that, I need to buy a new SSL certificate just for the www. I will talk with my boss and see if we really need to be compliant with this rule, because, to be honest, I don't think anybody will type https:/./www.level1.mydomain.com.
    – dasigrist
    Nov 14, 2019 at 19:35
  • Make sure you can use SNI before spending money on another certificate. Also, take a hard look at LetsEncrypt; it can be a very good alternative SSL Certificate provider.
    – Chris Davies
    Nov 19, 2019 at 0:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .