1

I have abc.example.com that is being shut down and all data was sent via SSL.

I have xyz.example.com already live and pure SSL site. I am changing record (CNAME) for abc.example.com to point to xyz.example.com. xyz.example.com already has a working cert. Do I need a cert for traffic originating from abc.example.com?

5

Yes, you'll still need an SSL certificate for abc.example.com

Due to the nature of CNAME redirection, when you type abc.example.com in the browser, the URL stays abc.example.com, and this is where you need the SSL certificate.


SEO Tips

You might want to use 301 redirects instead of CNAME redirect, this will pass on the ranking power/juice from abc.example.com to xyz.example.com.

However, this would still require an SSL certificate.

Have you tried Let's Encrypt ? a certificate authority that provides free SSL certificate.

  • Please do not say "CNAME redirect" this is both technically incorrect and creates confusion. Stephen's answers gives the detail but in short "redirection" is a layer 7 term, something given to you by the HTTP protocol. The DNS protocol is far below that and has no concept of redirection. A CNAME record is an alias or as initially defined so (with its own confusion) provides the Canonical Name for a given record. – Patrick Mevzek Sep 28 '18 at 16:00
  • Also no need to specifically plug one given CA, the question and answer are exactly the same with any CA whatsoever you choose for your certificates. Also as for categorizing this specific CA, some might say the important point is that it is free, others may say instead that the important point is that it is fully automated and implements the IETF standard ACME protocol (that other CAs could implement too). – Patrick Mevzek Sep 28 '18 at 16:01
3

Neverever's answer is correct. You do need an SSL certificate. I wanted to add that it is because there is no such thing as a CNAME redirect.

A CNAME is not a redirect. A CNAME instructs the DNS to resolve to the same domain as where the CNAME points. The CNAME does not cause a redirect. It only causes the HTTP request for a domain to be made to the same IP address as requests for another domain.

The process a browser and operating system actually uses for getting a redirect from https://site1.example/ to https://site2.example/ is:

  1. DNS lookup for site1.example. Discover it it is a CNAME for site2.example.
  2. DNS lookup for site2.example. Find an A record for its IP address (192.0.2.4, for example).
  3. Open a socket to the IP address 192.0.2.4 on port 443.
  4. Negotiate TLS (SSL) for the domain site1.example.
  5. Make the HTTPS request for https://site1.example/:

    GET / HTTP/1.1
    Host: site1.example
    
  6. Get the response back with the redirect:

    301 Moved Permanently
    Location: https://site2.example/
    
  7. Perform another DNS lookup for site2.example. Find an A record for its IP address (192.0.2.4, for example). The DNS response will come from DNS cache this time.
  8. Open a socket to the IP address 192.0.2.4 on port 443.
  9. Negotiate TLS (SSL) for the domain site2.example.
  10. Make the HTTPS request for https://site2.example/:

    GET / HTTP/1.1
    Host: site2.example
    
  11. Get the response back with the content:

    200 OK
    ...
    

Just to be able to redirect a HTTPS request you need DNS for that domain, a web server for that domain, and SSL for that domain. It doesn't actually matter if you use a CNAME record or an A record. A redirect can happen either way.

In fact, an A record is almost always more efficient. DNS lookups are faster with direct A records than with CNAME records. CNAME records require a second DNS lookup and don't make the rest of the redirection process easier.

  • "DNS lookups are faster with direct A records than with CNAME records." Things are cached, so besides edge cases I think the speed difference, if any, will be negligible after everything else taken into account (time of TLS handshake, time of HTTP headers transmission, etc.). Also with more and more DoT/DoH and web/DNS hosting companies being at the same time public resolvers, there will be shortcuts (it is the exact same discussion currently about "CNAME at apex", if you look at the ANAME record the auth server does the recursion before its reply) – Patrick Mevzek Sep 28 '18 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.