Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 1 down vote favorite

Possible Duplicate:
www.mydomain.com secure but not mydomain.com?

Hi

We've got our website running and https / ssl works just great.

EXCEPT

when users enter http://www.mydomain.com and then enter the secure area and get directed to httpS://www.mydomain.com it works fine.

But when users enter just http://mydomain.com and then enter the secure are and get directed to httpS://mydomain.com they get a warning about the certificate being from a website called "www.mydomain.com" while they're trying to enter "mydomain.com" ....

Does our SSL cert not cover both www.mydomain.com and mydomain.com? Are we suppose to buy TWO certs, on for each?? Surely not?

Any help or pointers to the standard way of doing things like this would be great.

We're using Apache HTTPD to forward requests to Tomcat webapps. Apache is taking care of all the SSL connections.

share|improve this question
2  
A little SEO note: It's wise to only use one of those forms. Redirect example.com to www.example.com, or vice-versa. – Andre Backlund Mar 21 '11 at 15:52

migrated from stackoverflow.com Mar 21 '11 at 17:57

marked as duplicate by John Conde♦ Mar 21 '11 at 18:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote 1 down vote

Make http://example.com redirect to https://www.example.com.

To answer your remaining questions, no - SSL certificate verification steps covers only the configured name. It is possible to obtain a certificate that covers more than one name; and is supported in all modern browsers.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.