SSL needed on redirect?

Question

I inherited a weird situation from a client that I'm no expert at. This client has 3 domain names, the main one being, for example, domain-a.com. They also have domain-b.com and domain-c.com redirecting to domain-a.com. All domains live on the same server.

So the problem comes up because they had SSL certs on all 3 domains and the cert on domain-c.com expired and they need to get a new one. This had me thinking, do they even need certs on domain-b or domain-c if it just redirects? Also consider that the domain-c.com domain is the domain of their email, but as far as I know, the two don't affect each other.

TL;DR: Do you need SSL certs on redirects to a page with an SSL cert.

Answer 1

Yes.

The redirection is an HTTP-level action which happens inside the SSL envelope.
The client needs to establish an SSL connection to the original host before it 'sees' the redirect, then after completing the redirect it must establish another SSL connection to the target host.
So you definitely need an SSL certificate on redirects to a page with one.