I just tried https://meta.codegolf.stackexchange.com and got a warning that this site cannot be accessed securely.
Is there a reason why PCG Meta is not accessible securely? Meta.SO for example is available in HTTPS.
\$\begingroup\$
\$\endgroup\$
4
1 Answer
\$\begingroup\$
\$\endgroup\$
6
With HTTPS certificates, you can't have a wildcard except at the start, and a wildcard can't match multiple components. So *.stackexchange.com can't match meta.codegolf.stackexchange.com; you'd need a *.codegolf.stackexchange.com certificate. Given how many Stack Exchange sites there are, that'd be a lot of certificates, which would cause problems in terms of trying to manage certificates (and require new certificates to be bought every time a new site went into beta). Thus, https://meta.codegolf.stackexchange.com doesn't work (and if you click that link, you'll see a bad certificate error).
The issue has now been fixed, though (by Stack Exchange globally); you'll notice that the URL for this Meta site is now https://codegolf.meta.stackexchange.com (i.e. the first two URL components were swapped). Community (Stack Exchange's diamond moderator bot) put in a lot of work swapping URL components in links all over the network, so that they'd be updated to point at the new home of the site. Because only a single certificate (for *.meta.stackexchange.com) is needed to cover all sitewide metas, there's no certificate issue any more. So the original problem has been solved; PPCG meta is indeed now available in HTTPS.
-
\$\begingroup\$ Well, meanwhile Let's Encrypt provides certificates for free, so I don't understand why all that link-moving was required. \$\endgroup\$ Commented Jun 13, 2017 at 5:58
-
1\$\begingroup\$ I'm pretty sure the problem wasn't the cost of the certificates (for a site like Stack Exchange), but rather the technical impact. IIRC the site does various crazy things with its certificates in order to ensure that it works in as many situations as possible. There's a blog post about it somewhere. \$\endgroup\$– user62131Commented Jun 13, 2017 at 6:40
-
\$\begingroup\$ @ThomasWeller Let's Encrypt limits certificates to 20/week/"registered" (second-level) domain. But even for paid authorities, there has to be some sort of automated process to get a few hundred certs or whatever for companies with scores of subdomains (or simply domains). \$\endgroup\$– Nick TCommented Jun 13, 2017 at 15:21
-
\$\begingroup\$ How would YOU like to register and serve 400 separate certificates? nickcraver.com/blog/2017/05/22/https-on-stack-overflow/… \$\endgroup\$ Commented Jun 13, 2017 at 18:17
-
\$\begingroup\$ @Draco18s: yes, that happens when you just try to do it all the automatic way. But it can be done better. \$\endgroup\$ Commented Jun 13, 2017 at 19:03
-
2\$\begingroup\$ @ThomasWeller I have no response. I am not a networking web admin engineer. I only pretended to be one at a job I no longer have. I linked the blog post because Nick is a smarter man than I am about those things and laid out the reasons why SO did it the way SO did it. \$\endgroup\$ Commented Jun 13, 2017 at 19:12
*.*.stackexchange.com) cannot use the same certificate as main (*.stackexchange.com). \$\endgroup\$