Apache Redirect from https to https

Question

I am trying to redirect without a rewrite rule from eg https://www.domain.com to https://www.domain.net . I have a wildcard certificate for *.domain.net . This yields the following warning in my error_log

[warn] RSA server certificate wildcard CommonName (CN) `*.domain.net' does NOT match server name!?

This makes sense and I understand why the warning. I would like to ask if there is a way to use the Redirect directive to accomplish the above without the warnings. Here is my virtual hosts in ssl.conf:

<VirtualHost *:443>
    SSLEngine on
    ServerName www.domain.net
    DocumentRoot /var/www/html/domain

    SSLOptions -FakeBasicAuth -ExportCertData +StrictRequire +OptRenegotiate -StdEnvVars
    SSLStrictSNIVHostCheck off
</VirtualHost>

<VirtualHost *:443>
    SSLEngine on
    ServerName www.domain.com
    ServerAlias www.domain.info
    Redirect permanent / https://www.domain.net
</VirtualHost>

Also, if there is a solution, can it be used for redirection from htps://domain.com to htps://www.domain.com? Thanks a lot!

Solution 1

Please be aware that the SSL handshake and verification process of the underlying HTTPS connection occurs before the actual request is sent. That means no HTTP response from the server before the authenticity of the server certificate has been verified, not even redirects.

If you only have one endpoint (ie. only 1 public IP address), you'll need to buy a SAN certificate, that is, a certificate with Subject Alternative Names.

That way you could have a wildcard certificate for *.domain.net with the SAN www.domain.com, and you won't get any certificate warnings

For further info, check out an old answer I gave for a similar situation, just with nginx instead of apache

Solution 2

www.domain.com (and for that matter www.domain.info) are not the same domain as www.domain.net, hence the warning. You should have certificates for those domains as well, if you need to avoid this warning.

Comments

[dortegaoh]

The step in between is completely useless, it only disrupts the encrypted requests. And the worst thing, the user doesn't even notice his connection was not encrypted for one step.