1

I am working on a site that only owns an SSL cert for domain.com. I am trying to remove the www. and redirect to domain.com. This I have working fine.

I also want to force HTTPS on all pages, this works fine if www. is not typed.

There error occurs when https://www.domain.com us the URL.

I can see it rewrite to https://domain.com but I get a cert error that I have to accept or reject.

Is there a way around this without buying another certificate?

Here are two of the many combinations of rules I have tried (many of them were from other SO answers).

1.

RewriteCond %{HTTP_HOST} ^(www\.)(.+) [OR]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(www\.)?(.+)
RewriteRule ^ https://%2%{REQUEST_URI} [R=301,L]

2.

RewriteCond %{HTTPS} =on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L]

RewriteCond %{SERVER_PORT} !^443
RewriteRule ^ https://domain.com%{REQUEST_URI} [R=301,L]
Jazzy
  • 6,029
  • 11
  • 50
  • 74
  • possible duplicate of [Redirect to 'www' before ssl requirement](http://stackoverflow.com/questions/10929534/redirect-to-www-before-ssl-requirement) – Bruno Aug 09 '12 at 22:27
  • Or these: http://stackoverflow.com/q/11640198/372643 http://stackoverflow.com/q/10442858/372643 – Bruno Aug 09 '12 at 22:31

1 Answers1

3

I don't think there's a way around this. The cert error is coming from the SSL (TLS) connection, which happens before any HTTP requests are made.

If the user went to http://www.domain.com/ or just http://domain.com/ you could redirect to https://domain.com/ just fine. If the user went to https://www.domain.com/, they would get a cert error before receiving a redirect.

I think your options are:

  1. Point www.domain.com to a server that has HTTPS disabled. Users would get a connection error when hitting https://www.domain.com/, which may be preferrable to a cert error
  2. Buy a cert for www.domain.com or *.domain.com
craig65535
  • 3,439
  • 1
  • 23
  • 49
  • 1
    @FrankFarmer `*.domain.com` won't match `domain.com`. The dot isn't part of the wildcard. – Bruno Aug 09 '12 at 22:25
  • @Bruno you're right. And they're apparently more expensive. Lame. – Frank Farmer Aug 09 '12 at 22:28
  • I had a feeling this was the answer I was going to get. Unless I get some genius answer, I will mark this as the answer. I would say that someone actually typing in https : //www. is pretty unlikely, although of course the client did it. Thanks. – Jazzy Aug 09 '12 at 22:39