Search code examples
apache.htaccessmod-rewritesslno-www

WWW to NON WWW Urls (Remove WWW) using Apache (.htaccess)

I have to redirect my website from https://www.example.com/ to https://website.com/.

SSL is properly installed on my server.

I am using Apache and have to do this using Apache (either httpd.conf/ssl.conf or .htaccess)

I have used almost all of the methods I could search for but none of them work for me.

  • http://www.example.com/ redirects properly to https://example.com/

  • http://example.com/ redirects properly to https://example.com/.

But

  • https://www.example.com/ does not redirect properly to https://example.com/.

It gives me "invalid certificate error" and when I add an exception (accept the certificate) in the browser then it redirects to https://example.com/. But I don't want to add this exception (adding the certificate in the browser).

Please note that my SSL certificate is issued for example.com and not www.example.com.

Following are my .htaccess rules and conditions

RewriteEngine On

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://{REQUEST_URI} [L,R=301]

RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [R=301,QSA,NC,L]

I have used the following too but these didn't work either:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} !^example.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Used this as well but no luck

RewriteEngine On
RewriteCond %{HTTP_HOST} !^example.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

No luck with this too

RewriteEngine on
RewriteCond %{HTTP_HOST} ^www\.
RewriteRule ^(.*)$ http://example.com/$1 [R=301,L]

I have tried 5-6 other solutions (similar to above) but none worked. All work for the first two patterns I mentioned above but none work for https://www.

Note that these conditions of .htaccess are reached, I mean .htaccess is not being ignored. I have verified this using redirects and also the two patterns mentioned above are working as well.

In httpd.conf/ssl.conf the AllowOverride directive is set to All.

I have access to httpd.conf/ssl.conf.

PHP Version 5.5.29

Apache 2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.5.29

Hostname:Port example.com:443

Last but not least my website https://example.com/ does not open in Internet Explorer and Safari and give certificate issues (errors) but when I check my domain using SSL checkers (multiple) then all SSL checkers mentions that SSL is properly installed.

Check this image, this will explain things better:

Browsers reporting SSL cert error

Complete .htaccess is given below:

Options +FollowSymlinks 
DirectoryIndex index.html Home.php index.php

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^www\.(.*)
RewriteRule ^.*$ https://%1/$1 [R=301,L]

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://{REQUEST_URI} [L,R=301]

RewriteRule ^(blogs)($|/) - [L]
RewriteRule ^(.*)/$ index.php?mod=resturants&name=$1&%{QUERY_STRING} [L]
RewriteRule ^$ Home.php [L]
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_URI} /+[^\.]+$
RewriteRule ^(.+[^/])$ %{REQUEST_URI}/ [R=301,L]
</IfModule>
Solution

  • Please note that my SSL certificate is issued for website.com and not www.website.com.

    That is your main problem. You are never going to be able to redirect from www to non www without a valid certificate for www. The reason is the connection is handled first before the web server processes anything else including any rewrite rules. So when your browser connects to your site using the https protocol, it has to check for a valid certificate because that's the very nature of SSL to make sure the connection is secure. Then once that is done, Apache will process web server rules that you have in place like rewrites. So it can't rewrite from www to non www until the connection is completed correctly. In order for that to happen you also need a certificate for www as well. The rewrite rules are not the problem.

    This topic comes up quite frequently and there is no way around it. That's the nature of SSL/encryption and how it works.

    When buying a cert, try not buying just the domain name, because some CA's will only give you that without www. But if you use www.example.com in your CSR you will get both www.example.com and example.com in the same certificate 99% of the time. Then you won't have to worry about this issue. They are stupid cheap so it shouldn't be an issue to get another one. SSls.com has them for 4.99/yr.