5

My client's primary domain name is a variant of a commonly spelled name, for example domein.com. To avoid losing traffic, they also purchased domain.com. The live site is at https://domein.com. When I do a 301 redirect of http://domain.com (that doesn't have SSL) to https://domein.com, it generates an insecure connection warning.

Is it possible to do this without generating a warning? Is it necessary for domein.com to have an SSL certificate?

  • 3
    When I do a 301 redirect of domain.com to domain.com or to domain.com, is this a typo?? ;-) What web server are you using? Are you using a control panel? Are you using a web host or registrar provided option? If you are redirecting yourself on your web server, can you include the code? That may help. Cheers!! – closetnoc Aug 26 '16 at 1:14
  • Typo (self-facepalm in disgust). It should read "301 redirect of http://domein.com to http://domain.com or to https://domain.com," This is through a shared host with a cPanel. I'm using the redirection option in cPanel. – Ray Mitchell Aug 26 '16 at 12:04
  • Get an SSL cert for the misspelled domain. Better yet, get a multi domain cert that includes both domains. – user2320464 Aug 30 '16 at 20:26
  • 1
    I think you still have a mix-up between domein and domain in your question? .... If the "live site is at https://domein.com", then why would you "do a 301 redirect of http://domein.com to http://domain.com or to https://domain.com"? Presumably that should be the other way round... domain.com to domein.com? "Is it necessary for domein.com to have an SSL certificate?" - if your "live site is at https://domein.com" then presumably domein.com must already have an SSL cert? – MrWhite Sep 2 '16 at 21:11
  • @w3dk - Yeaaah. I saw that after I posted the bounty. I was really hoping this question would go away quietly. I was being too cute by half in writing up the question. But the client's situation is just that mistake inducing. Your analysis is correct. domain.com does not have SSL and must be redirected to https://domein.com – Ray Mitchell Sep 3 '16 at 23:16
1

Yes you need a certificate to redir https://domein.com to https://domain.com. This is because of the handshake that occurs before anything is picked up and routed. The browser will flag it as insecure, or it may not allow you to go through the redir at all in some cases such as HSTS.

As mentioned in the other answer, there is Let's Encrypt, which offers free 90 day certificates. However, unless your host uses WHM 58+ and has installed the LE AutoSSL patch, you will not have this option available. This is because you are on a shared server and there is no cPanel frontend for LE. It's only available via WHM backend. Once your shared host goes v58 with the AutoSSL patch, and makes it available to your account via "Feature Manager", then any attached domain will be able to use SSL. There is a caveeat though -- the domain must not be a forwarder, else LE won't be able to make a .tmp file route (or .well-known folder) to verify the domain is indeed yours, nor to auto renew it in the future.

So StartSSL is another option for free certificates too. It requires a bit of manual intervention, although they are starting to automate too. You could generate one and manually put it in via cPanel. Same rules may apply to the automate, only in this case its probably not going to be available on a shared host. So I have a better idea:

Use Cloudflare.

Cloudflare is a zone manager, has free SSL certs, it's a CDN, has page rules or forwarding, etc. Using the flexible SSL you are able to secure any domain, regardless whether the underlying server has a certificate or not. This is by far the most hassle-free way to get a free SSL on a forwarder domain.

0

If the original request is for a HTTP page without SSL then it won't fire a warning. Make the search default/links for that site http: instead of https:. The issue is that it's checking the certificate against the initially requested domain and finding it invalid.

The alternative is to get a certificate that covers both. You can get one for free with the Lets Encrypt project. They don't do wild cards but there's no limit to named domains that can be included.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.