Domain Changes, 301 Redirects, HTTPS and Secure Certificate Surprises

There’s been a new trend toward running entire websites (every single page) in secure mode, otherwise known as HTTPS, SSL, encrypted mode, etc. But there’s something lurking in the shadows.

April 2019 Update: Wanted to check in and confirm the information in this article is still correct and relevant.

Major websites like Twitter, Facebook, LinkedIn and most Google properties are all fully browser-to-server encrypted. Google even started using it as a positive marker for search engine rankings. These are all clear signs this issue does need serious consideration.

Many pages and posts around the web are dedicated to optimizing your secure web server, mixed content issues and other important considerations. But there is one problem that doesn’t seem to get mentioned as often.

Imagine the following scenario.

You decide to make your website entirely https and you buy a secure certificate for you domain name. Some time down the road you change your mind and want to use a different domain name, but you have already established your first domain and it is linked from other websites and is in Google searches.

Your first thought might be to simply use 301 redirects, those work great, but here is the gotcha. To successfully redirect, a browser must first request the old website URL and then the redirect occurs. Oh snap! Remember, in this scenario all of your pages are already being accessed using https style URL’s.

Are you starting to see the issue? You have to keep an up-to-date secure certificate for both your old domain and your new domain!

Without a valid secure certificate those old URL’s WILL NOT redirect, instead they will show a scary web browser security warning and stop dead in their tracks.

You can not redirect from an https URL to any other URL without having a valid secure certificate installed on the initial https domain.

If you’ve run into this issue or need more in depth help, please consider reaching out.