I have my site configured on apache and now I'm trying to set up re-directions correctly.

My site uses wildcard SSL certification and my ssl certificate covers *.mydomain.com. My certificate provider only covers one level subdomain. My site URL is https://level1.mydomain.com, but I want to redirect users that go to https://www.level1.mydomain.com to https://level1.mydomain.com. I setup the redirection from www.level1 to level1, but when I type https://www.level1.mydomain.com on my browser I get

This server could not prove that it is www.level1.mydomain.com; its security certificate is from *.mydomain.com. This may be caused by a misconfiguration or an attacker intercepting your connection.

As I understand, the reason is that www.level1 is a level2 subdomain and my wildcard does not cover that.

What do I need to do? Buy another certificate for www.level1? If yes, how should I configure the virtualhost so both certificates point to the same DocumentRoot folder?

thank you.

  • Instead of using a redirect, you could purchase another certificate and use a second Apache virtualhost for www.level1.mydomain.com but pointing to the same DocumentRoot. You would need to be careful about how you reference your application internally , but it would certainly meet the criteria you stated.
    – Thomas N
    Nov 13 '19 at 19:11
  • @ThomasN you would need SNI enabled for that to work. (I don't know offhand how/if that's handled in Apache's vHost configuration.)
    – roaima
    Nov 19 '19 at 0:09
  • 1
    @roaima The page you linked to says it all, I think; Apache server supports SNI since version 2.2.12. Since the current major version is 2.4.*, I'd think it would be pretty well defined.
    – Thomas N
    Nov 19 '19 at 18:58

AFAIK if you just enter


into your browsers addressbar, you request the mydomain.com webserver on port 80 http protocol. For http you don't need a certificate.

if you enter


you ask on port 443 / https which needs a certificate.

If you enter


and only configured your webserver to work with https/443 you'll get an error message, webserver not listening to port 80 (502 bad gateway - or whatever).

You need to add redirects/rewrites for all domains/virtual hosts listening on port 80/http to https. This is easy - no certificates needed -

like so (untested)

<VirtualHost *:80>
   ServerName level1.mydomain.com       
   Redirect / https://level1.mydomain.com

<VirtualHost *:80>
   ServerName  www.level1.mydomain.com
   Redirect / https://level1.mydomain.com

For all users typing


You would need to buy an extra certificate or get a free letsencrypt.org certificate for this sub.sub.domain just for redirecting. Maybe not worth the trouble.

BTW adding a second virtual host pointing to the same DocumentRoot could work for plain HTML pages but not for applications. I would go with redirects.

Tutorial about redirects/rewrites

About letsencrypt

  • Thank You for your answer. It is much clear now. The reason I asked is that we are using the Rank Math SEO plugin and his site analysis complains that "The www and non-www versions of your URL are not redirected to the same site." so, to do that, I need to buy a new SSL certificate just for the www. I will talk with my boss and see if we really need to be compliant with this rule, because, to be honest, I don't think anybody will type https:/./www.level1.mydomain.com.
    – dasigrist
    Nov 14 '19 at 19:35
  • Make sure you can use SNI before spending money on another certificate. Also, take a hard look at LetsEncrypt; it can be a very good alternative SSL Certificate provider.
    – roaima
    Nov 19 '19 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.