What's wrong with certificate?

What's wrong with security certificate for this site?

1 Answer 1


The name in the certificate does not match the host name to use. The certificate is valid for lots of different names and includes wildcards such as *.meta.stackexchange.com (which would match against unix.meta.stackexchange.com) but no name which matches against meta.unix.stackexchange.com. Note that the included *.stackexchange.com will not match because a wildcard matches only a single label, i.e. meta or unix but not meta.unix.

  • Any ideas if that can be fixed? Commented Mar 19, 2015 at 7:16
  • Make the certificate match the hostname, that is either change the certificate or the name used to access the site. Commented Mar 19, 2015 at 7:28
  • So that doubles the cost of certificates for all SO meta sites, so the solution is to go for cheaper SSL provider. Or is is possible to have a certificate that allows to match *.*.stackexchange.com? Commented Mar 19, 2015 at 9:36
  • Multiple wildcards within a single entry are not possible, but you can have multiple entries in the subject alternative section within the same certificate and each of these can use wildcards. Commented Mar 19, 2015 at 10:27
  • Some Background: nickcraver.com/blog/2013/04/23/…
    – Oded
    Commented Mar 23, 2015 at 11:16
  • @techtonik - it isn't just cost. It is also about management. Most SE sites fall under a single *.stackexchange.com cert. with meta.*.stackexchange.com would be well over 100 certificates. That's a significant cost in managing them. Multiple wildcards are technically possible (but due to past abuse, no provider will do them).
    – Oded
    Commented Mar 23, 2015 at 11:18
  • @Oded: Multiple wildcards in a single name are not supported by current browsers. And RFC6125 explicitly restricts wildcards to the leftmost label and thus effectively prohibits multiple wildcard inside a single entry too (there is only a single leftmost label). Commented Mar 23, 2015 at 11:42
  • @Oded, so the problem is on the side of certificate agency that doesn't provide API to issue certificates automatically? I don't believe that SO doesn't use some tools like Ansible to automate certificate management on their side. Commented Mar 24, 2015 at 3:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .