4

What's wrong with certificate?

What's wrong with security certificate for this site?

3

The name in the certificate does not match the host name to use. The certificate is valid for lots of different names and includes wildcards such as *.meta.stackexchange.com (which would match against unix.meta.stackexchange.com) but no name which matches against meta.unix.stackexchange.com. Note that the included *.stackexchange.com will not match because a wildcard matches only a single label, i.e. meta or unix but not meta.unix.

8
  • Any ideas if that can be fixed? Mar 19 '15 at 7:16
  • Make the certificate match the hostname, that is either change the certificate or the name used to access the site. Mar 19 '15 at 7:28
  • So that doubles the cost of certificates for all SO meta sites, so the solution is to go for cheaper SSL provider. Or is is possible to have a certificate that allows to match *.*.stackexchange.com? Mar 19 '15 at 9:36
  • Multiple wildcards within a single entry are not possible, but you can have multiple entries in the subject alternative section within the same certificate and each of these can use wildcards. Mar 19 '15 at 10:27
  • Some Background: nickcraver.com/blog/2013/04/23/…
    – Oded
    Mar 23 '15 at 11:16
  • @techtonik - it isn't just cost. It is also about management. Most SE sites fall under a single *.stackexchange.com cert. with meta.*.stackexchange.com would be well over 100 certificates. That's a significant cost in managing them. Multiple wildcards are technically possible (but due to past abuse, no provider will do them).
    – Oded
    Mar 23 '15 at 11:18
  • @Oded: Multiple wildcards in a single name are not supported by current browsers. And RFC6125 explicitly restricts wildcards to the leftmost label and thus effectively prohibits multiple wildcard inside a single entry too (there is only a single leftmost label). Mar 23 '15 at 11:42
  • @Oded, so the problem is on the side of certificate agency that doesn't provide API to issue certificates automatically? I don't believe that SO doesn't use some tools like Ansible to automate certificate management on their side. Mar 24 '15 at 3:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .