I inherited a weird situation from a client that I'm no expert at. This client has 3 domain names, the main one being, for example, domain-a.com. They also have domain-b.com and domain-c.com redirecting to domain-a.com. All domains live on the same server.
So the problem comes up because they had SSL certs on all 3 domains and the cert on domain-c.com expired and they need to get a new one. This had me thinking, do they even need certs on domain-b or domain-c if it just redirects? Also consider that the domain-c.com domain is the domain of their email, but as far as I know, the two don't affect each other.
TL;DR: Do you need SSL certs on redirects to a page with an SSL cert.
Yes.
The redirection is an HTTP-level action which happens inside the SSL envelope.
The client needs to establish an SSL connection to the original host before it 'sees' the redirect, then after completing the redirect it must establish another SSL connection to the target host.
So you definitely need an SSL certificate on redirects to a page with one.
If you have requests via TLS to domain-b & domain-c than yes, you need TLS support on them.
There's also a security related aspect in this. Plain text communication to domain-b.com & domain-c.com means a plain text redirect to domain-a.com. Because it redirects to SSL only the communication to domain-a.com is secured. This leaves the redirect from domain-b & domain-c vulnerable to a MITM attack. An attacker can intercept the requests and redirect the client to a different site under their control.
This is not easy to prevent, unless you have something like HTTP Strict Transport Security (HSTS, RFC) in place on all domains and the visitor visited the sites before or they're in preload list of their browser.
In any case, to make it more secure: Upgrade the client to TLS on their first request to any of the three domains, and redirect to https instead of http when going to domain-a from domain-b & domain-c. Use HSTS with preload and HTTP Public Key Pinning on all domains and you're good to go.
