2
\$\begingroup\$

I just tried https://meta.codegolf.stackexchange.com and got a warning that this site cannot be accessed securely.

Is there a reason why PCG Meta is not accessible securely? Meta.SO for example is available in HTTPS.

\$\endgroup\$
4
  • 3
    \$\begingroup\$ HTTPS is still in beta and meta (*.*.stackexchange.com) cannot use the same certificate as main (*.stackexchange.com). \$\endgroup\$
    – Dennis
    Aug 25 '15 at 21:42
  • \$\begingroup\$ @Dennis: so it's all just a matter of money? \$\endgroup\$ Aug 25 '15 at 21:48
  • 2
    \$\begingroup\$ I don't know. This is really a question for Meta Stackexchange, which already has around 100 questions about SSL support. \$\endgroup\$
    – Dennis
    Aug 25 '15 at 21:52
  • \$\begingroup\$ The warning basically says if you ignore it, and visit meta.codegolf.stackexchange.com insecurely in HTTPS anyway, only someone who runs stackexchange.com and codegolf.stackexchange.com (if we ignore CloudFlare for now) can attack you. \$\endgroup\$
    – jimmy23013
    Aug 26 '15 at 5:13
6
\$\begingroup\$

With HTTPS certificates, you can't have a wildcard except at the start, and a wildcard can't match multiple components. So *.stackexchange.com can't match meta.codegolf.stackexchange.com; you'd need a *.codegolf.stackexchange.com certificate. Given how many Stack Exchange sites there are, that'd be a lot of certificates, which would cause problems in terms of trying to manage certificates (and require new certificates to be bought every time a new site went into beta). Thus, https://meta.codegolf.stackexchange.com doesn't work (and if you click that link, you'll see a bad certificate error).

The issue has now been fixed, though (by Stack Exchange globally); you'll notice that the URL for this Meta site is now https://codegolf.meta.stackexchange.com (i.e. the first two URL components were swapped). Community (Stack Exchange's diamond moderator bot) put in a lot of work swapping URL components in links all over the network, so that they'd be updated to point at the new home of the site. Because only a single certificate (for *.meta.stackexchange.com) is needed to cover all sitewide metas, there's no certificate issue any more. So the original problem has been solved; PPCG meta is indeed now available in HTTPS.

\$\endgroup\$
6
  • \$\begingroup\$ Well, meanwhile Let's Encrypt provides certificates for free, so I don't understand why all that link-moving was required. \$\endgroup\$ Jun 13 '17 at 5:58
  • 1
    \$\begingroup\$ I'm pretty sure the problem wasn't the cost of the certificates (for a site like Stack Exchange), but rather the technical impact. IIRC the site does various crazy things with its certificates in order to ensure that it works in as many situations as possible. There's a blog post about it somewhere. \$\endgroup\$
    – user62131
    Jun 13 '17 at 6:40
  • \$\begingroup\$ @ThomasWeller Let's Encrypt limits certificates to 20/week/"registered" (second-level) domain. But even for paid authorities, there has to be some sort of automated process to get a few hundred certs or whatever for companies with scores of subdomains (or simply domains). \$\endgroup\$
    – Nick T
    Jun 13 '17 at 15:21
  • \$\begingroup\$ How would YOU like to register and serve 400 separate certificates? nickcraver.com/blog/2017/05/22/https-on-stack-overflow/… \$\endgroup\$ Jun 13 '17 at 18:17
  • \$\begingroup\$ @Draco18s: yes, that happens when you just try to do it all the automatic way. But it can be done better. \$\endgroup\$ Jun 13 '17 at 19:03
  • 2
    \$\begingroup\$ @ThomasWeller I have no response. I am not a networking web admin engineer. I only pretended to be one at a job I no longer have. I linked the blog post because Nick is a smarter man than I am about those things and laid out the reasons why SO did it the way SO did it. \$\endgroup\$ Jun 13 '17 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .