2

I own a couple of domains, each with a static site serving plain HTML pages. Let say one at www.example.com and another www. example.org. If I enter http :// www. example.com or http:/ /www.example.org, it all works fine. However, if I enter https:// www. example.com or https:// www.example.org, I first get a warning about the security certificate not being issued by a trusted authority, but if I continue I see a whole other website, nothing I created. Both these addresses I see the same website. Also, both of my sites are hosted by the same company.

My questions are:

  • How is this possible and should it be possible?
  • Is this legal?
  • Am I a victim of some malicious hacking attempt?
  • Is my web hosting service provider to blame?
  • and most importantly, how can I fix this?
  • "but if I continue I see a whole other website" What website? Some generic one served by your hoster? – Jan Doggen Aug 4 '14 at 13:23
  • No, it is somebody else's site. I Googled their name I found their correct address. Can I assume this is not normal? My hosting provider says everything is fine. – Johan Aug 5 '14 at 9:11
1

It is possible to show a different page for http and https, depending on your webserver configuration. Answers to your questions:

  • How is this possible and should it be possible? It is depending on your hosters configuration. If you set the webserver up to listen on port 80 with a particular configuration and on port 443 with another configuration.

  • Is this legal? I don't see why not (no laws are broken here)... It's just publishing alternate content on another location. If you agreed with your hoster that they would provide a valid SSL certificate and host an SSL site, you can ask them to fix the configuration.

  • Am I a victim of some malicious hacking attempt? You might be, depending on the intent of your hosting provider, but probably they didn't configure SSL properly.

  • Is my web hosting service provider to blame? Yes, and no. Yes as in, they set up this configuration, and if you agreed to something else, they should fix it. No as in, if you didn't agree on SSL functionality, they're not obliged to provide it.

  • And most importantly, how can I fix this? Ask your hosting provider.

1
  • Yes its possible
  • Nothing illegal is taking place(based on what you have stated)
  • unlikely
  • YES!! their servers are taking the requests and creating the responses.
  • Contact hosting company

Most likely the other site is also hosted by the same company and the wires/config files have got screwed up somewhere.

1
  1. Yes, it is possible by rerouting HTTPS traffic (typically a different port) to a different domain. That is possible in server settings.
  2. There is no legal problem, no. At least, not in the United States. I, for one, would redirect HTTP traffic to a page to inform users that they need to use HTTPS traffic for certain features, or if the situation warranted it, would redirect HTTP traffic to use HTTPS.
  3. A hacking attempt? Not likely, it seems more likely that....
  4. Your web hosting provider has a setting somewhere you did not see about treating HTTPS traffic. To fix it...
  5. Look for some settings about Document Roots or SSL traffic or HTTPS traffic. If that fails, you can always go to the forums or support line for your provider.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.