# Why is PCG meta not available in HTTPS?

I just tried https://meta.codegolf.stackexchange.com and got a warning that this site cannot be accessed securely.

Is there a reason why PCG Meta is not accessible securely? Meta.SO for example is available in HTTPS.

• HTTPS is still in beta and meta (*.*.stackexchange.com) cannot use the same certificate as main (*.stackexchange.com). Aug 25 '15 at 21:42
• @Dennis: so it's all just a matter of money? Aug 25 '15 at 21:48
• I don't know. This is really a question for Meta Stackexchange, which already has around 100 questions about SSL support. Aug 25 '15 at 21:52
• The warning basically says if you ignore it, and visit meta.codegolf.stackexchange.com insecurely in HTTPS anyway, only someone who runs stackexchange.com and codegolf.stackexchange.com (if we ignore CloudFlare for now) can attack you. Aug 26 '15 at 5:13

With HTTPS certificates, you can't have a wildcard except at the start, and a wildcard can't match multiple components. So *.stackexchange.com can't match meta.codegolf.stackexchange.com; you'd need a *.codegolf.stackexchange.com certificate. Given how many Stack Exchange sites there are, that'd be a lot of certificates, which would cause problems in terms of trying to manage certificates (and require new certificates to be bought every time a new site went into beta). Thus, https://meta.codegolf.stackexchange.com doesn't work (and if you click that link, you'll see a bad certificate error).
The issue has now been fixed, though (by Stack Exchange globally); you'll notice that the URL for this Meta site is now https://codegolf.meta.stackexchange.com (i.e. the first two URL components were swapped). Community (Stack Exchange's diamond moderator bot) put in a lot of work swapping URL components in links all over the network, so that they'd be updated to point at the new home of the site. Because only a single certificate (for *.meta.stackexchange.com) is needed to cover all sitewide metas, there's no certificate issue any more. So the original problem has been solved; PPCG meta is indeed now available in HTTPS.