Possible Duplicate:
www.mydomain.com secure but not mydomain.com?


We've got our website running and https / ssl works just great.


when users enter http://www.mydomain.com and then enter the secure area and get directed to httpS://www.mydomain.com it works fine.

But when users enter just http://mydomain.com and then enter the secure are and get directed to httpS://mydomain.com they get a warning about the certificate being from a website called "www.mydomain.com" while they're trying to enter "mydomain.com" ....

Does our SSL cert not cover both www.mydomain.com and mydomain.com? Are we suppose to buy TWO certs, on for each?? Surely not?

Any help or pointers to the standard way of doing things like this would be great.

We're using Apache HTTPD to forward requests to Tomcat webapps. Apache is taking care of all the SSL connections.

  • 2
    A little SEO note: It's wise to only use one of those forms. Redirect example.com to www.example.com, or vice-versa. – Andre Backlund Mar 21 '11 at 15:52

Make http://example.com redirect to https://www.example.com.

To answer your remaining questions, no - SSL certificate verification steps covers only the configured name. It is possible to obtain a certificate that covers more than one name; and is supported in all modern browsers.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.