Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
www.mydomain.com secure but not mydomain.com?


We've got our website running and https / ssl works just great.


when users enter http://www.mydomain.com and then enter the secure area and get directed to httpS://www.mydomain.com it works fine.

But when users enter just http://mydomain.com and then enter the secure are and get directed to httpS://mydomain.com they get a warning about the certificate being from a website called "www.mydomain.com" while they're trying to enter "mydomain.com" ....

Does our SSL cert not cover both www.mydomain.com and mydomain.com? Are we suppose to buy TWO certs, on for each?? Surely not?

Any help or pointers to the standard way of doing things like this would be great.

We're using Apache HTTPD to forward requests to Tomcat webapps. Apache is taking care of all the SSL connections.

share|improve this question

migrated from stackoverflow.com Mar 21 '11 at 17:57

This question came from our site for professional and enthusiast programmers.

marked as duplicate by John Conde Mar 21 '11 at 18:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

A little SEO note: It's wise to only use one of those forms. Redirect example.com to www.example.com, or vice-versa. – Andre Backlund Mar 21 '11 at 15:52

Make http://example.com redirect to https://www.example.com.

To answer your remaining questions, no - SSL certificate verification steps covers only the configured name. It is possible to obtain a certificate that covers more than one name; and is supported in all modern browsers.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.