We've got our website running and HTTPS / SSL works just great.
EXCEPT: when users enter
http://www.mydomain.com and then enter the secure area and get directed to
https://www.mydomain.com it works fine.
But when users enter just
http://mydomain.com and then enter the secure are and get directed to
https://mydomain.com they get a warning about the certificate being from a website called
www.mydomain.com while they're trying to enter
Does our SSL cert not cover both
mydomain.com? Are we suppose to buy TWO certs, on for each?? Surely not?
Any help or pointers to the standard way of doing things like this would be great. We're using Apache HTTPD to forward requests to Tomcat web apps. Apache is taking care of all the SSL connections.