SSL Certification on both www and no-www domains

Question

We've got our website running and HTTPS / SSL works just great.

EXCEPT: when users enter http://www.mydomain.com and then enter the secure area and get directed to https://www.mydomain.com it works fine.

But when users enter just http://mydomain.com and then enter the secure are and get directed to https://mydomain.com they get a warning about the certificate being from a website called www.mydomain.com while they're trying to enter mydomain.com ....

Does our SSL cert not cover both www.mydomain.com and mydomain.com? Are we suppose to buy TWO certs, on for each?? Surely not?

Any help or pointers to the standard way of doing things like this would be great. We're using Apache HTTPD to forward requests to Tomcat web apps. Apache is taking care of all the SSL connections.

Answer 1

SSL, be default, covers one domain. In your case it's www.domain.com. Users who go to https://domain.com will see that error message as domain.com is not explicitly covered by that SSL certificate.

To over come this you can:

1) Get a wild card SSL certificate which covers subdomains in addition to the main domain. This is nice as it's flexible and let's you encrypt as many subdomains as you want but also a lot more expensive.

2) Redirect your users from domain.com to www.domain.com. Besides being easy to do and free, it's also smart usability as it gives your users a consistent URL to use (and see).

To do this in Apache you can put this in an .htaccess file in your root web directory:

Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTP_HOST} !^(www\.|$) [NC]
RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Answer 2

By default, it does not. You have to buy a wild-card ssl certificate to get that working. You can also specify multiple hosts in the ssl certificate.

Another option is to always redirect to a canonical domain. In this case, it makes sense to redirect from domain.com to www.domain.com.