In MP version 2.9.0.1 if you have a primary domain setup with SSL (such as www.mysite.com) other pointer domains don't work such as www.pointerdomain.com or pointerdomain.com. The pointers will error out because there's no SSL on the pointer domains and Mojor isn't switching traffic to the preferred domain. It used to be that the preferrerd domain setting would route users over to the correct domain that has SSL. It's not doing that now (I've checked multiple installs and multiple sites, all pointer domains error out)

Hello. HSTS isn't enabled.

The redirects have always worked before the latest version. That's the whole point to allowing multiple domains in Mojo and the preferred domain. I'd think. Otherwise why even have those options if mojo will only accept one domain? Something changed. I have 50+ pointer domains that have all stopped working. Multiple pointer domains is a fairly common need.

Here's a working example of an older CMS install (v 2.7.0.0):
This non-SSL (http://www.versascreengutterprotection.com) domain redirects to the preferred SSL domain: https://www.edgemeltsystems.com

Another example in a v2.7.0.2 install:
http://www.gsbservicesllc.com points to https://www.mysheetmetalguy.com

Any new CMS installs such as 2.9.0.1 do not work. I'm not sure v2.9.0.0. Worked or exactly what latest version it stopped working, but I think it's the latest one since the last time I set up a pointer domain it worked fine. I'm just noticing it in this latest version.

I hope this provides a hint.

We're looking at supporting your scenario. What changed was that if SSL is enabled, it is always enabled, everywhere, for every request. This is the best security possible. It's also best for SEO. Any fix will need to circumvent that to some extent so it will be an option that you will need to enable in web.config.

What we always do is use Let's Encrypt (Certify the Web on Windows is awesome) to create a certificate with all of the domains. This ensures all requests for all legitimate domains on the site are secured.

Edited to add: browsers always try https first and then, if no connection can be made to a domain via https, they'll try http. Having all domains included on one or multiple certificates is the best way to handle this scenario.

Thanks,
Joe

Eric,

Mojo has been updated to consolidate the SSL and preferred hostname redirects and it should fix your issue. The changes are in the GitHub repository and will be in the upcoming release.

Please note that going to a URL without SSL in a private window will show an error matter what (it's a browser thing), but everything works as intended in normal mode.

Thanks,
Elijah