SSL_ERROR_BAD_CERT_DOMAIN

Question

SSL certificate is valid only for website without www

I set my site with SSL certificate. It is on posidonia.ga but if I connect then Firefox shows this warning: ""Websites guarantee their identity through certificates. Firefox does not consider this site reliable as it uses a certificate that is not valid for www.posidonia.ga. The certificate is valid only for posidonia.ga.

Error code: SSL_ERROR_BAD_CERT_DOMAIN""

So how could I connect to https://www.posidonia.ga if my SSL certificate is valid only for posidonia.ga (without www)?

I've read I could solve adding these lines to .htaccess:

RewriteEngine on
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

But the problem is still there.

Please help, thanks.

RewriteEngine on
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

I expect connecting https://www.posidonia.ga without warning: SSL_ERROR_BAD_CERT_DOMAIN

Answer 1

You have two problems:

1) your certificate is only for posidonia.ga hence it will never cover www.posidonia.ga and any HTTPS connection to that hostname with this certificate will get rejected by clients due to name mismatch. You need a new certificate having either www.posidonia.ga or *.posidonia.ga as a SAN (Subject Alternative Name), alongside the current posidonia.ga . You need to generate a new certificate for this goal, you can not just "update" the current one.

2) Your certificate is issued by

E = support@cacert.org
CN = CA Cert Signing Authority
OU = http://www.cacert.org
O = Root CA

This is a CA that is not included by default in browsers (see http://wiki.cacert.org/InclusionStatus for full list on where it is included by default or not), hence they reject your certificate as unknown issuer.

To add the CA in browsers, have a look at http://wiki.cacert.org/FAQ/ImportRootCert and http://wiki.cacert.org/FAQ/BrowserClients depending on your needs.

It can be as simple as http://www.cacert.org/index.php?id=3 and accepting the prompts, or more complicated depending on your OS/browser/setup/policies.