This is the scenario:
There is a valid SSL certificate configured in Apache for www.example.ac.za.
There is a parked domain of www.example.co.za without a valid SSL certificate.
To avoid having to purchase two certificates the client would like the .co.za to redirect to .ac.za. I understand (and have found) that this can not be done in the .htaccess as the presentation of the SSL certificate is done first.
Can one turn SSL off for .co.za but have it remain on for .ac.za? Would this resolve the problem?
Additional Info
These domains are configure in Apache as VirtualHosts with their own .conf and ssl.conf files.
Redirects are done to make sure the root of these domains end up at https://www.example.ac.za
Would appreciate some insight pls :)
Can one turn SSL off for .co.za but have it remain on for .ac.za? Would this resolve the problem?
You can remove the SSL vhost for .co.za so if someone attempts to go to https://www.example.co.za they'd get a site not found. But if you want anything to appear when they go to the https website for .co.za, then there must be something listening to the SSL port (443) that expects requests for the .co.za domain. And like you understand, in order to do that, you need a valid certificate unless you're ok with the security exception.
The other thing you can do is buy a single cert for both domains. There's nothing else you can do in the server/vhost configs. Doesn't matter if it's htaccess or not, a redirect happens after a successful SSL handshake.
Related
I have a website for my podcast built with Python / Django that is hosted on Heroku: https://dinpodcast.herokuapp.com/
I have a custom domain parked on GoDaddy, dinpodcast.com, that has a www CNAME directing to my heroku application. This works just fine: https://www.dinpoddcast.com
I wanted dinpodcast.com to redirect to the www website, so I have the following domain forwarding set up on Godaddy:
This also works great, for the most part. Now, when I enter http://dinpodcast.com, or just dinpodcast.com, both will redirect to https://www.dinpodcast.com.
Here's the problem. When I enter the naked domain WITH HTTPS, so when I enter https://dinpodcast.com into a browser's address bar, I get the following response:
Here's what I THINK is happening. My SSL certificate is provided by Heroku under their Automated Certificate Management program. So, I assume that since I don't have an SSL certificate with GoDaddy, it's timing out trying to find one before it can redirect to my www subdomain. Would this be correct? If so, is there any way around this WITHOUT buying an SSL certificate with GoDaddy? If that's not what's happening, then what is and how do I fix it?
When you create an ssl certificate in your domain do you include your root domain? Tried using this tool in your root domain and it seems that there is no ssl certificate. However the subdomain https://dinpodcast.herokuapp.com/ has one. I suggest putting an ssl certificate in all subdomain and root domain that you are using.
I also checked the root domain’s IP address using this tool and checked port 443 using another tool and apparently the port is closed. Double check your firewall and make sure 443 is open.
I am pretty new with the domain configuration part. I want to know that can I generate SSL only for my subdomain I didn't want to add the root domain with CLOUDFLARE because my root domain already has SSL certificate. Is it possible to do that? I have purchased my domain from the GODADDY. I will add the generated SSL certificate to IIS.
Please help me out !!
Edit: I don't want to add my root domain to CLOUDFLARE because if I will do it I have to change my NAMESERVER for the same and my root domain already has SSL.
I believe what you're looking for is the CNAME setup on Cloudflare. This is the alternative method of Name Server setup. However, this setup requires a Business plan. With CNAME setup, you can have just a certain subdomains to be used with Cloudflare. With proxy turned on the subdomain, you'd get the usual Universal SSL certification from Cloudflare.
I am facing a weird issue. I do not know if it is Nginx related or DNS related but here is the problem :
I have a domain that is fine, let's say foobar.com , SSL does not face any issue. Both www. and root domain work with HTTPS.
I have a second domain, let's say foobaz.net, I need to redirect it to foobar.com in every situations (both www. and root domains).
It does actually redirect, but when I try to access https://foobaz.net/ I get a HTTPS error/warning before being redirected to https://foobar.com/ after adding it the the SSL exceptions of Chrome (https://foobar.com/ SSL certificate is OK once I get past https://foobaz.net/ SSL warning).
I do not know if it is Nginx related or DNS related, any clue of what is happening here ?
Thanks in advance.
Any https connection checks the ssl certificate before proceeding to do what it needs to do in the server(in your case, a redirection). You may have a certificate for foobar.com, which is perfectly fine, but if you don't have a valid foobaz.com certificate. That's why the error shows up, foobaz is not "secure".
A https connection is secure if all the points between you and the endpoint are secure, not only the endpoint. If foobaz is not certified, that is a non-secure middle point on your connection, and that's why the warning happens.
Get a SSL certificate for foobaz too, and the whole connection will be secure.
I can't use my SSL certificate on subdomains because it is for the top level domain www.tld.com only. When I force it on a subdomain e.g. dev.tld.com I get a warning.
What I want to achieve is a development subdomain on the same shared hosting webspace where I can test under real conditions, especially concerning payment systems where an SSL connection is mostly mandatory.
My question is: Do I have to get an extra certificate or is it possible to just click the warning away and make use of https? Am I obliged to buy a certificate in order to use SSL technically? At least it seems to work once I've told my browser to trust the subdomain ...
The warning is telling you that the domain name listed in the certificate does not match the domain name you browsed to. You will still have an SSL connection. Since you are the one that configured the environment, you can ignore the warning.
Having said that, a wildcard SSL certificate is not much more expensive than one for a single domain (shop around!). I would suggest your next SSL certificate be for a wildcard domain (*.tld.com). That will avoid the issue of the warning entirely.
I am currently running nginx and have an ssl certification that is only on my domain and no sub domains. I do however have some sub-domains I like to use on the non-ssl so I want to keep my wildcard subdomains.
I was wondering if there was a way to make all ssl subdomains die and not resolve to anything. I would make them redirect but because of my ssl certification, the scary error message pops up before the server redirect them. I would rather have the page come up as nothing.
THanks
Because of how SSL works, you will always have a "scary error message" if someone comes to https://sub.domain.com/ and your SSL certificate doesn't list sub.domain.com as one of its canonical names.
The only ways around this are:
old good "Dedicated IP+Dedicated certificate" for every subdomain you host in SSL
Wildcard certificate
Web server with SNI support in SSL and per subdomain certificates
A certificate with SAN propogated with all your subdomains
Which one to choose depends on your budget and how many browser/OS combinations you have to support.
I hope it answers your question, feel free to clarify it if not.