CODEWITHSUNDEEP
apache.htaccessssl-certificate
punkbit
punkbit

Reputation: 7717

Rewrite www to non-www fails on https www when SSL Cert is non-www

I've tried to first rewrite www to non-www for both http and https. Works for http requests, but for https requests, the browser shows 'connection is not private' when www is present.

My SSL certificate is assigned to non-www. I'm wondering if there's a way to redirect the https www to non-www ? So far I've tried different examples without success:

RewriteEngine On

RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

The following error message is displayed in the browser (when https://www.example.com):

Your connection is not private

This server could not prove that it is www.example.com; its security certificate is from foobar.com. This may be caused by a misconfiguration or an attacker intercepting your connection.

So far I think it's not possible unless I have the SSL certificate for www.example.com otherwise the connection will never happen and the server won't send a redirection response.

Upvotes: 2

Views: 1229

Answers (1)

C3roe
C3roe

Reputation: 96424

So far I think it's not possible unless I have the SSL certificate for www.foobar.com otherwise the connection will never happen and the server won't send a redirection response.

Exactly.

The browser will try to set up an HTTPS connection to the server, but since the certificate presented is not valid for the domain name, it will break it off.

So in this scenario you do not even get to the point where you could rewrite the request.

You will need to get a certificate that includes both the www and the non-www version of your domain name, if you want this to work in user’s browsers.

Upvotes: 2

Related Questions