重定向安全域是否需要在兩個域上都有SSL證書？

Question

我在Microsoft Azure上託管一個站點，我需要將舊域（domain1.com）的重定向添加到新域（www.domain2.com）。但是我遇到的問題是，重定向工作正常，在不安全的網址：

http://domain1.com - >https://www.domain2.com

http://www.domain1.com - >https://www.domain2.com

但是它並沒有在安全正常工作網址：

https://domain1.com - >https://www.domain2.com

https://www.domain1.com - >https://www.domain2.com

什麼情況是，我得到一個證書警告，即給定的證書是無效此域。如果我接受警告，重定向發生到新域名就好了。

這表明我一切工作正常，它只是在重定向發生在瀏覽器之前協商ssl，並且因爲在第一個域上沒有ssl證書，我收到警告。它是否正確？

有什麼我在這裏失蹤？有一個更好的方法嗎？我需要兩個域的SSL證書嗎？

這裏是我的web.config文件，所以你可以看到我的配置：

<?xml version="1.0" encoding="UTF-8"?> 
<configuration> 
    <system.webServer> 
    <!-- Don't show directory listings for URLs which map to a directory. --> 
    <directoryBrowse enabled="false" /> 
    <rewrite> 
     <rules> 
     <rule name="Protect files and directories from prying eyes" stopProcessing="true"> 
      <match url="\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$" /> 
      <action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Access is forbidden." /> 
     </rule> 

     <rule name="Force simple error message for requests for non-existent favicon.ico" stopProcessing="true"> 
      <match url="favicon\.ico" /> 
      <action type="CustomResponse" statusCode="404" subStatusCode="1" statusReason="File Not Found" statusDescription="The requested file favicon.ico was not found" /> 
      <conditions> 
      <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" /> 
      </conditions> 
     </rule> 

     <!-- Rewrite URLs of the form 'x' to the form 'index.php?q=x'. --> 
     <rule name="Short URLs" stopProcessing="true"> 
      <match url="^(.*)$" ignoreCase="false" /> 
      <conditions> 
      <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" /> 
      <add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" /> 
      <add input="{URL}" pattern="^/favicon.ico$" ignoreCase="false" negate="true" /> 
      </conditions> 
      <action type="Rewrite" url="index.php?q={R:1}" appendQueryString="true" /> 
     </rule> 

     <rule name="Redirect old-domain to new-domain" stopProcessing="true" enabled="true"> 
      <match url="(.*)" /> 
      <conditions> 
      <add input="{HTTP_HOST}" pattern="^(www.)?domain1.com$" /> 
      </conditions> 
      <action type="Redirect" url="https://www.domain2.com/{R:0}" appendQueryString="true" redirectType="Permanent" /> 
     </rule> 

     <rule name="WWW Rewrite" enabled="true"> 
      <match url="(.*)" /> 
      <conditions> 
      <add input="{HTTP_HOST}" negate="true" pattern="^www\." /> 
      <add input="{HTTP_HOST}" negate="true" pattern="localhost" /> 
      </conditions> 
      <action type="Redirect" url="https://www.domain2.com/{R:0}" appendQueryString="true" redirectType="Permanent" /> 
     </rule> 

     <!-- Force HTTPS Starts --> 
     <rule name="Force HTTPS" enabled="true"> 
      <match url="(.*)" /> 
      <conditions> 
      <add input="{HTTPS}" pattern="off" ignoreCase="true" /> 
      </conditions> 
      <action type="Redirect" url="https://www.domain2.com/{R:1}" appendQueryString="true" redirectType="Permanent" /> 
     </rule> 
     <!-- Force HTTPS Ends --> 

     </rules> 
    </rewrite> 

    <httpErrors> 
     <remove statusCode="404" subStatusCode="-1" /> 
     <error statusCode="404" prefixLanguageFilePath="" path="/index.php" responseMode="ExecuteURL" /> 
    </httpErrors> 

    <defaultDocument> 
     <!-- Set the default document --> 
     <files> 
     <remove value="index.php" /> 
     <add value="index.php" /> 
     </files> 
    </defaultDocument> 
    </system.webServer> 
</configuration> 

Answer 1

您將能夠對非安全URL重定向到HTTP/HTTPS。但是，除非您已安裝有效的SSL證書，否則您將無法將HTTPS URL（https://domain1.com）重定向到任何HTTP/HTTP（https://www.domain2.com）。

http://domain1.com -> https://www.domain2.com [YES, with or without SSL] 
http://www.domain1.com -> https://www.domain2.com [YES, with or without SSL] 

而且，

https://domain1.com -> https://www.domain2.com [Required Valid SSL certificate for domain1.com] 
https://www.domain1.com -> https://www.domain2.com [Required Valid SSL for domain1.com] 

這就是爲什麼你得到錯誤爲「定證書無效此域」，因爲你還沒有有效的證書。請注意，如果您希望舊網址在新的HTTPS網址上重定向，您必須在舊網域和新網域上均安裝SSL證書。