Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a server which has a DynDNS subdomain (let's call it I also have a proper domain with a CNAME pointing to that subdomain (let's call it has a self-signed SSL certificate, while has a proper CA-signed SSL certificate.

I've set up Apache to redirect non-ssl requests for either domain to, which works fine. My problem is this: I want anyone trying to access to get redirected to I've tried 2 solutions and neither get it quite right:

  1. Have 1 VirtualHost, using the CA certificate. This obvious gives a horrible warning about domain using the wrong certificate when someone tries to access
  2. Have 2 VirtualHosts, one for with the self-signed certificate and one for using the proper certificate. The has a redirect clause that redirects all traffic to, which works except that you still the the self-signed certificate warning. Also, some non-web browser HTTP clients (like wget) get's certificate when pointed at

Is there a way I can get around this problem?

share|improve this question
up vote 1 down vote accepted

This is a problem in the protocol stack. You can only have one SSL certificate per IP per Port.

The reason is the following: The VirtualHost system of apache and alike is based on the HTTP Host Header. However, this header is sent after the SSL connection is established (as all headers are sent after establishing the SSL connection, otherwise it would be a bit of useless).

So, the only means the server has to choose a certificate are based on the interface or IP the connection is incoming on and the port.

A solution for the warning would be though to add your second domain as SubjectAltName to the certificate.

share|improve this answer

You could use Server Name Indication, if your clients support it. (See this answer on SO for links.)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .