https://www redirect on single domain certificate

Question

If I have a SSL certificate for

https://www.example.com

but not for

https://example.com

I found here that I should use

#First rewrite any request to the wrong domain to use the correct one (here www.)
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

#Now, rewrite to HTTPS:
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

for correct redirecting. This seems to work, except for one case:

If I enter https://example.com then this won't get redirected to https://www.example.com. Instead I get this:

Is this fixable without buying a SSL certificate for https://example.com?

Hi, please try to stick to one question per post; it gets awkward to handle voting, duplicates, etc, if the two parts have different answers. — IMSoP, Sep 02 '18 at 10:27

score 1 · Answer 1 · answered Sep 02 '18 at 10:38

To understand which certificates you need, you need to understand when the browser checks them, and when the server has a chance to issue a redirect.

HTTPS essentially "wraps" an HTTP session inside a TLS session, so the request and response look, very roughly, like this:

Browser: can I have a TLS session please?
Server: Sure, let's start doing cryptography stuff!
Browser: What X509 certificate are you signing with? If it makes a difference, I'm going to request a resource on "example.com"
Server: Here's a certificate for "example.com", and some intermediate certificates so you can trace it to an issuer you trust.
Browser: OK, that meets my requirements. Let's talk HTTP.
Browser: I'd like to GET resource / on host example.com please.
Server: Please redirect your user to this new URL: https://www.example.com

As you can see, by the time the server has any chance to redirect, the browser already needs to have established a TLS connection and decided that it trusts it, so an invalid certificate will never be allowed to sign the redirect.

This is actually a very good thing: otherwise, somebody hijacking a site could just redirect all its traffic to somewhere they owned a certificate for, without ever generating a trusted certificate for the hijacked domain.

https://www redirect on single domain certificate

1 Answers1