Why is my website only secure when the url has a trailing slash?

[agagaga]

Username (e.g. epiz_XXX) or Website URL

imagienworld.rf.gd

So I recently registered an SSL certificate, and I was confused as to why it wasn’t work. Today I found out, that it only works if the url has a trailing slash at the end. (ie. imagienworld.rf.gd/)
Why is that?

[YT_Xaos]

This doesn’t seem to occur to me. When I type https://imagienworld.rf.gd, it shows “Secure”. Have you tried redirecting all traffic to HTTPS?

How to force all traffic to HTTPS

After you’ve enabled SSL for your website, you’ll probably want to redirect all traffic on your website to the https version of your site. There are multiple ways to do that. Let’s compare some commonly used ways. Using script configuration Some scripts (including Wordpress) have a setting which allows you to set your website URL. By changing this URL from http://example.com to https://example.com, the script will probably redirect visitors to the https version of your site. Even if your script…

[agagaga]

Why do I have to redirect all traffic to HTTPS? Shouldn’t all urls now under my infinityfree domain, be secure? Also, why are the subdomains I registered under the imagienworld account not secure?

For example I registered xxx.rf.gd (I’m not going to share the real name) with the cpanel for my imagienworld account. Doing https://xxx.rf.gd doesn’t work, but https://imagienworld.rf.gd works?

[wackyblackie]

@agagaga

Why do I have to redirect all traffic to HTTPS? Shouldn’t all urls now under my infinityfree domain, be secure?

Because that’s how this works. You got an SSL cert, but for it to do anything, you have to redirect all traffic to the secure version of your site.

@agagaga

For example I registered xxx.rf.gd (I’m not going to share the real name) with the cpanel for my imagienworld account. Doing https://xxx.rf.gd doesn’t work, but https://imagienworld.rf.gd works?

This is because we don’t have a wildcard cert for rf.gd (it would be too hard to manage). You have to get an SSL cert for each subdomain you create.

[YT_Xaos]

@agagaga

Shouldn’t all urls now under my infinityfree domain, be secure?

No, you receive an SSL certificate for the domain you chose.

@agagaga

Why do I have to redirect all traffic to HTTPS?

If you don’t want to, then don’t. But that would mean that some people may not trust your site.

[agagaga]

@wackyblackie

This is because we don’t have a wildcard cert for rf.gd (it would be too hard to manage). You have to get an SSL cert for each subdomain you create.

What if I create a subdomain for my subdomain? ie. xxx.imagienworld.rf.gd

[Greenreader9]

Then you will need another certificate on that sub-sub-domain

[Admin]

@agagaga

Today I found out, that it only works if the url has a trailing slash at the end. (ie. imagienworld.rf.gd/)
Why is that?

It’s not. SSL certificates are valid for a particular hostname. Different sub paths on your website cannot have different SSL certificates.

@agagaga

What if I create a subdomain for my subdomain? ie. xxx.imagienworld.rf.gd

If you got a certificate from ZeroSSL, the certificate is actually valid for all direct subdomains of imagienworld.rf.gd (so it’s valid for xxx.imagienworld.rf.gd, but not yyy.xxx.imagienworld.rf.gd).

But our control panel won’t accept certificates that are not valid exclusively for the hostname you’re trying to install them to, so you’ll still have to request a separate certificate.