Redirect to ‘www’ before ssl requirement

by

HTTPS is HTTP over TLS/SSL (see RFC 2818), which first establishes the SSL/TLS connection before any HTTP traffic is sent. Any redirection (via mod_rewrite, custom PHP code or other) will always apply after the SSL/TLS connection is established.

Not doing so would actually be a security issue, since an attacker could rewrite and redirect the client before the certificate has been verified.

If you want to redirect from https://domain.com to https://www.domain.com, the certificate obtained for https://domain.com must be valid for domain.com (and then, the certificate obtained for https://www.domain.com must be valid for www.domain.com).

(You could use two different certificates with Server Name Indication if the two hosts are served on the same IP address, but this is rather convoluted.)

The easiest would be to obtain a certificate that’s valid for both domain.com and www.domain.com. This can be done using a single certificate with multiple Subject Alternative Name entries. Most CAs should be able to issue such certificates. Some do it without additional fee.

More Related Contents:

  1. Cannot modify header information [duplicate]
  2. PHP generate file for download then redirect
  3. Why I have to call ‘exit’ after redirection through header(‘Location..’) in PHP?
  4. cURL error 60: SSL certificate: unable to get local issuer certificate
  5. PHP page redirect [duplicate]
  6. Paypal Access – SSL certificate: unable to get local issuer certificate
  7. PHP Redirect to another page after form submit
  8. Session lost when switching from HTTP to HTTPS in PHP
  9. How to get the real URL after file_get_contents if redirection happens?
  10. Page redirect after certain time PHP
  11. PHP Redirection with Post Parameters
  12. Socket transport “ssl” in PHP not enabled
  13. php ratchet websocket SSL connect?
  14. php get url of redirect from source url
  15. Redirect with CodeIgniter
  16. Redirect to page and send custom HTTP headers
  17. TLS 1.2 not working in cURL
  18. GMail fsockopen(): SSL operation failed error with Codeigniter and XAMPP
  19. nginx redirect loop, remove index.php from url
  20. Change WordPress Admin URL
  21. PHP header location-redirect doesn’t work – why? [duplicate]
  22. PHP Header Redirect in a new window?
  23. Redirect after Login on WordPress
  24. Setting up SSL on a local xampp/apache server
  25. What is the best way to notify a user after an access_control rule redirects?
  26. Connect to remote MySQL server with SSL from PHP
  27. cURL requires CURLOPT_SSL_VERIFYPEER=FALSE
  28. Setting up PHPMailer with Office365 SMTP
  29. PHP to MySQL SSL Connections
  30. How to cause a redirect to occur before php script finishes?

Leave a Comment