Virtual Hosts

All websites are accessible via a domain name. For example the University home page is accessible at www.adelaide.edu.au. You can also get to it by dropping the www, and just using adelaide.edu.au. Both names refer to the same server, or host. For the purposes of this discussion a website with its own domain name(s) is said to be served on a "virtual host".

Security Certificates

When a website has secure content, the HTTPS protocol is used to serve those pages or files. Typically you are asked to log in before seeing the content, and at this point the first part of the address displayed in your browser switches from http:// to https://. When this happens your browser and the server exchange security certificates and establish an encrypted connection.

The web cluster for corporate sites uses a wildcard certificate that covers domain names of the form *.adelaide.edu.au. Strictly according to the standard covering SSL certificates, this doesn't cover names matching *.*.adelaide.edu.au.

However most browsers have a relaxed implementation in this respect and allow the single wildcard "*" to cover deeper levels of subdomains. IE6 raises a warning that is trivially dismissed, but IE7 and up give more dire looking errors.

Several steps have been taken to avoid this issue:

• All virtual hosts have dual configs to work with and without www.
• Links to log into a secure site automatically have www. stripped
• All links in HTML documents matching https://www.*.adelaide.edu.au have the www. stripped
• Creation of new subdomains is discouraged for public sites

If you have a website on a subdomain, a good workaround is to always refer to your website as <my-site-name>.adelaide.edu.au and never add the www prefix.