What's wrong with security certificate for this site?
Add a comment
|
The name in the certificate does not match the host name to use. The certificate is valid for lots of different names and includes wildcards such as *.meta.stackexchange.com (which would match against unix.meta.stackexchange.com) but no name which matches against meta.unix.stackexchange.com. Note that the included *.stackexchange.com will not match because a wildcard matches only a single label, i.e. meta or unix but not meta.unix.
-
-
Make the certificate match the hostname, that is either change the certificate or the name used to access the site. Mar 19 '15 at 7:28
-
So that doubles the cost of certificates for all SO meta sites, so the solution is to go for cheaper SSL provider. Or is is possible to have a certificate that allows to match
*.*.stackexchange.com? Mar 19 '15 at 9:36 -
Multiple wildcards within a single entry are not possible, but you can have multiple entries in the subject alternative section within the same certificate and each of these can use wildcards. Mar 19 '15 at 10:27
-
-
@techtonik - it isn't just cost. It is also about management. Most SE sites fall under a single
*.stackexchange.comcert. withmeta.*.stackexchange.comwould be well over 100 certificates. That's a significant cost in managing them. Multiple wildcards are technically possible (but due to past abuse, no provider will do them).– OdedMar 23 '15 at 11:18 -
@Oded: Multiple wildcards in a single name are not supported by current browsers. And RFC6125 explicitly restricts wildcards to the leftmost label and thus effectively prohibits multiple wildcard inside a single entry too (there is only a single leftmost label). Mar 23 '15 at 11:42
-
@Oded, so the problem is on the side of certificate agency that doesn't provide API to issue certificates automatically? I don't believe that SO doesn't use some tools like Ansible to automate certificate management on their side. Mar 24 '15 at 3:41