Self-signed certificates with permanent redirects and www subdomain in apache2

Question

On my local Mac machine I have the following apache conf snippet:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com

    Redirect permanent / https://www.example.com
</VirtualHost>

<IfModule mod_ssl.c>
    <VirtualHost *:443>
        ServerName example.com
        ServerAlias www.example.com

        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/my_example.cert
        SSLCertificateKeyFile /etc/apache2/ssl/my_example.key
    </VirtualHost>
</IfModule>

When I open https://example.com in Chrome or Safari no problem. However, if I open https://www.example.com with Chrome I get:

NET::ERR_CERT_COMMON_NAME_INVALID

Subject: example.com
Issuer: example.com

In Safari I just get a generic "can't connect to the server" message. I forget the command off the top of my head, but you can check the values of the .cert file. For common name it outputs example.com. Is that the problem? Does that value need to be a wildcard? And if so, how do you enter a wildcard when prompted making the cert?

Also, what should the permanent redirect value be? Does it matter if it's https://example.com or https://www.example.com?

Answer 1

If you want to redirect from https on one domain to https on the other, you either need a wildcard certificate or two separate certificates.

Regular certificates only match if the hostname is exactly the same. Wildcard certificates will match the domain without a subdomain or the domain with any subdomain. Sub-subdomains (like https://sub.sub.example.com) however, will not match in most browsers (the standards were ambiguous about this case until recently).