How to 301 redirect old domain to new domain on same host with SSL and avoid Privacy Error

Question

Here's the environment:

• Apache, mod_rewrite.c exists
• WordPress
• Two domains that point to the same webhost, we'll call them
  • www.olddomain.com
  • www.newdomain.com

We have an SSL Certificate for www.newdomain.com, but not www.olddomain.com, as per the rules about needing two separate IPs for separate SSL certificates.

My current .htaccess file works great EXCEPT when you type in **https**://www.olddomain.com

Then the browser throws a Privacy Error "Your connection is not private" type page.

Here's what the .htaccess looks like:

Please note that the WordPress section and the Spam Referrer section probably have nothing to do with this, but I'm including them in case they're causing problems:

Options +FollowSymLinks -MultiViews
RewriteEngine on
#
# if requested hostname is non-blank
RewriteCond %{HTTP_HOST} .
# and if requested hostname is NOT "newdomain.com"
RewriteCond %{HTTP_HOST} !^www\.newdomain\.com
# redirect to same object in correct domain
RewriteRule (.*) https://www.newdomain.com/$1 [R=301,L]

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

##Block Spam Referrer
SetEnvIfNoCase Referer blackhatworth.com spam=yes
SetEnvIfNoCase Referer priceg.com spam=yes
Order Allow,Deny
Allow from all
Deny from env=spam

Answer 1

While it isn't impossible to host multiple secure sites on a single IP address, thanks to SNI and SAN, the redirect you're trying to do is impossible without one of the aforementioned solutions. In order to receive a redirect from https://www.olddomain.com, the browser must have already requested that URL using SSL/TLS, and is expecting an encrypted response from the web server with a valid certificate for that domain - even if that response is only a 301.

Answer 2

This is easy to do, and the only piece of the puzzle missing is an SSL cert for olddomain.com. Forget the idea about IP addresses restricting you, this misunderstanding is the root cause of your issue.

'Domain Validated' (or DV) certificates are very inexpensive and available from multiple vendors for well under $10 USD. I have used cheapsslsecurity.com and gogetssl.com, but there are many others and the product is identical so buy one anywhere you like. Grab a DV certificate for olddomain.com to use for the redirect.

The reason browsers return the error is because the SSL protocol is a separate layer which encapsulates the HTTP protocol, and the SSL session takes place before the HTTP session can begin. That prevents your HTTP redirect from happening - we aren't at that layer yet.

Simply put, you need to present a valid certificate for the SSL handshake, then your redirect happens. The redirect code goes in your Apache config (either a VirtualHost block or .htaccess) along with the certificate paths like this:

<VirtualHost 127.0.0.1:443>

  # Declare this rule only for the old domain
  ServerName OLDDOMAIN.com

  # Certificates presented so we can move on to the next step
  SSLEngine on
  SSLCertificateFile      /PATH/TO/CERT.crt
  SSLCertificateChainFile /PATH/TO/CHAIN-FILE.pem
  SSLCertificateKeyFile   /PATH/TO/KEY.key

  # Use a redirect, it is far more efficient than using rewrite
  Redirect 301 / https://www.NEWDOMAIN.com/

</VirtualHost>

Good luck and be aware that some hosts exploit this idea that SSL/TLS is somehow complicated or expensive and charge extortionate prices for it, or place unnecessary requirements like making you pay extra for a dedicated IP address. If your host told you this simply abandon them and move your sites elsewhere.

Answer 3

I'd like to point out a couple of things.

1. This is totally possible. I have it set up right now. Part of the problem is that you are rewriting URLs rather than redirecting them. Rewriting just changes what domain up in the browser or what file actually gets called, but it doesn't actually change your domain. You have to use a redirect for that.

2. As of Apache 2.4 (released in 2012!), you can use conditionals in order to perform the redirect. Here's an example.

<If "req('Host') != 'newdomain.com'">
    RedirectMatch 301 (.*) https://newdomain.com$1
</If>

This is nice because it also keeps the same path ($1) through the redirect.

The only catch, as mentioned in a previous answer, is that you have to have a valid SSL certificate for the old domain in order to redirect from https to https, however that's a small barrier in 2020.