Can a use a masked redirect from an alternate domain using the HTTPS of the main domain?

Question

I have a domain redirected toward a server where my site is hosted secured with an SSL. So, if I enter https://site.example I get from my hosting server a page with the nice little padlock, the page is secure.

Now I have redirected (masked) my domain http://otherserver.example toward https://site.example and if I enter the URL of the domain http://otherserver.example I get the page alright but is marked "Connection is not secure" with a crossed padlock.

Is there a way to use the security of the server to make the redirection secure as well?

Answer 1

No. Not the way you describe it. Masking is marketing speak for embedding a site within another site (using an iframe), and its a questionable practice at best. The takeaway point is that the http site has no way of utilizing the https site because from the browser pov its a seperate request.

If you think about it another way if it were possible to force another site to make your site https you would destroy much of the value of https - knowing you are talking to the site you think you are (ie you would be opening systems up to man-in-the-middle attacks)

Answer 2

If you want to support HTTPS on your other domain you MUST get a security certificate that covers that domain. You won't be able to simply frame mask your main domain without users seeing security warnings.

Masking is typically implemented at your domain registrar as a redirect option. It is almost NEVER a good option. It uses HTML frames to show your main site inside the alternate domain. It is bad for users because the URL doesn't change as the user navigates the site. They won't be able to bookmark or share links to deep pages. Search engines see right through the frames and only index the main domain.

Domain registrars are typically very bad at implementing domain redirects. I used GoDaddy to do so for years until I realized that the redirect was failing randomly a significant portion of the time, especially for bots. Even when domain registrars get the redirect itself right, they don't provide security certificates so that the alternate domain can be used with HTTPS.

Other options

Host both domains

If you really want users to be able to use either domain and see the same content, you should add the alternate domain to your web hosting account. It is technically possible to configure two domains to share the same directory root so they have the same content. Many web hosts have options for configuring sites like this.

You would need to get security certificates for both domains, or get a single certificate that covers both domains with the subject alternative name (SAN) option.

That type of setup is not ideal for SEO. Search engines typically index just one of two domains that have the same content. You would need to use canonical meta tags to tell search engines which domain you would prefer to have indexed.

Redirect with HTTPS

The most common thing to do with an alternate domain is redirect to to the main domain. Even if you want to redirect, you need to get a security certificate for the alternate domain to support HTTPS.

The best third party service for redirecting domains that I have been able to find is Cloudflare. It is free, their redirects are reliable, and they support HTTPS automatically for you. The down side is that it is a bit difficult to set up. To use Cloudflare, follow the instructions I created for setting up domain redirects using their free-tier service.