www.mydomain.com secure but not mydomain.com?
We've got our website running and https / ssl works just great.
when users enter
http://www.mydomain.com and then enter the secure area and get directed to
httpS://www.mydomain.com it works fine.
But when users enter just
http://mydomain.com and then enter the secure are and get directed to
httpS://mydomain.com they get a warning about the certificate being from a website called "www.mydomain.com" while they're trying to enter "mydomain.com" ....
Does our SSL cert not cover both www.mydomain.com and mydomain.com? Are we suppose to buy TWO certs, on for each?? Surely not?
Any help or pointers to the standard way of doing things like this would be great.
We're using Apache HTTPD to forward requests to Tomcat webapps. Apache is taking care of all the SSL connections.