Apache HTTPS redirection certificate error

问题:

We have two domains (gis4business.co.uk and gis4business.com) that point to the same website hosted using apache. We are using SSL for the entire site and have a wildcard SSL certificate for *.gis4business.co.uk.

The default apache conf file (000-default.conf) has a single virtual host configured to redirect from http to https as follows:

<VirtualHost *:80>
   ...
   Redirect permanent "/" "https://www.gis4business.co.uk/"
</VirtualHost>

Then we have a default SSL config file (default-ssl.conf) that has single a virtual host configured as follows:

<VirtualHost _default_:443>
    ServerName gis4business.co.uk
    ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
    ...
    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/privatekey.key
    SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt
</VirtualHost>

This configuration is working as expected for the following urls:

• http://www.gis4business.co.uk
• http://www.gis4business.com
• https://www.gis4business.co.uk

However, the url https://www.gis4business.com results in a certificate warning (SSL_ERROR_BAD_CERT_DOMAIN in firefox and ERR_CERT_COMMON_NAME_INVALID in chrome).

Its obviously complaining about the SSL certificate not matching the domain (gis4business.com), so I assume we need an HTTPS redirect from gis4business.com to gis4business.co.uk. We have experimented with various configurations and haven't managed to get a redirect working.

We have tried:

1) Adding another virtual host (*:443) to the top of the 000-default.conf file as follows:

<VirtualHost *:443> 
    ServerName gis4business.co.uk
    ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
    Redirect permanent "/" "https://www.gis4business.co.uk/"
    ...
    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/privatekey.key
    SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt 
</VirtualHost>

2) Adding another virtual host (default:443) to the top of the default-ssl.conf file as follows:

<VirtualHost _default_:443>
    ServerName gis4business.co.uk
    ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
    Redirect permanent "/" "https://www.gis4business.co.uk/"
    ...
    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/privatekey.key
    SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt
</VirtualHost>

If redirection of https from one domain to another is possible without certificate errors, then what is the correct configuration to make it work?

回答1:

Let's see how the redirect directive works

The Redirect directive maps an old URL into a new one by asking the client to refetch the resource at the new location.

The first request is processed by apache generating a 30x response to automatically redirect browser to the new URL

           browser                       SERVER             SSL  cert
https://www.gis4business.com       -->  redirect     *.gis4business.co.uk
           302-redirect            <-- 
https://www.gis4business.co.uk/    -->  process      *.gis4business.co.uk

The first request is served from https://www.gis4business.com using a certificate issued to *.gis4business.co.uk, so it is considered invalid consequently

To fix it you need to use a certificate issued to www.gis4business.com or *.gis4business.com. Define a new virtual host or request a new certificate with both hostnames.