Just got an error message that required me to add an exception for this meta as a result of a mismatch between the glebal SSL cert of Stack Exchange, and this meta.
Is anyone else getting this error, and if so, are there any plans to fix this?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
This is status-bydesign.
The reason for this is outlined in Nick Craver's (a Stack Exchange developer) blog post:
Ok so the top level domains are easy, a SAN cert which allows many domains on a single cert – we can sanely combine up to 100 here. So what about all of our *.stackexchange.com domains? A wildcart cert, excellent we’re knocking these out like crazy. What about meta.*.stackexchange.com? Damn. Can’t do that. You can’t have a wildcard of that form – at least not one supported by most major browsers, which means effectively it’s not an option. Let’s see where these restrictions originate.
Section 3.1 of RFC 2818 is very open/ambiguous on wildcard usage, it states:
Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.
It doesn’t really disallow meta.*.stackexchange.com or ..meta.stackexchange.com. So far so good…then some jerk tried to make a certificate for *.com which obviously wasn’t good, so that was revoked and disallowed. So what happened? Some other jerk went and tried ..com. Well, that ruined it for everyone. Thanks, jerks.
The rules were further clarified in Section 6.4.3 of RFC 6125 which says (emphasis mine):
The client SHOULD NOT attempt to match a presented identifier in which the wildcard character comprises a label other than the left-most label (e.g., do not match bar.*.example.net)
This means no ..stackexchange.com or meta.*.stackexchange.com. Enough major browsers conform to this RFC that it’s a non-option.
More information is outlined in this Meta Stack Exchange post: Better HTTPS support for Stack Exchange sites.
So the short version of this is that you can't get a meta.*.stackexchange.com certificate, so this isn't going to be fixed yet until they can find a good solution to this problem.
answered Apr 25, 2014 at 21:08
-
$\begingroup$ Good answer, though just to be clear "*.meta.stackexchange.com" would work, right? $\endgroup$– blundersCommented Apr 25, 2014 at 21:12
-
$\begingroup$ @blunders Yup, though then they would have to move over all of these
meta.*.stackexchange.comdomains over to*.meta.stackexchange.com, which would be a lot of work. Not sure what they're planning on doing. $\endgroup$– hichris123 ModCommented Apr 25, 2014 at 21:16