4

What's wrong with certificate?

What's wrong with security certificate for this site?

3

The name in the certificate does not match the host name to use. The certificate is valid for lots of different names and includes wildcards such as *.meta.stackexchange.com (which would match against unix.meta.stackexchange.com) but no name which matches against meta.unix.stackexchange.com. Note that the included *.stackexchange.com will not match because a wildcard matches only a single label, i.e. meta or unix but not meta.unix.

  • Any ideas if that can be fixed? – anatoly techtonik Mar 19 '15 at 7:16
  • Make the certificate match the hostname, that is either change the certificate or the name used to access the site. – Steffen Ullrich Mar 19 '15 at 7:28
  • So that doubles the cost of certificates for all SO meta sites, so the solution is to go for cheaper SSL provider. Or is is possible to have a certificate that allows to match *.*.stackexchange.com? – anatoly techtonik Mar 19 '15 at 9:36
  • Multiple wildcards within a single entry are not possible, but you can have multiple entries in the subject alternative section within the same certificate and each of these can use wildcards. – Steffen Ullrich Mar 19 '15 at 10:27
  • Some Background: nickcraver.com/blog/2013/04/23/… – Oded Mar 23 '15 at 11:16
  • @techtonik - it isn't just cost. It is also about management. Most SE sites fall under a single *.stackexchange.com cert. with meta.*.stackexchange.com would be well over 100 certificates. That's a significant cost in managing them. Multiple wildcards are technically possible (but due to past abuse, no provider will do them). – Oded Mar 23 '15 at 11:18
  • @Oded: Multiple wildcards in a single name are not supported by current browsers. And RFC6125 explicitly restricts wildcards to the leftmost label and thus effectively prohibits multiple wildcard inside a single entry too (there is only a single leftmost label). – Steffen Ullrich Mar 23 '15 at 11:42
  • @Oded, so the problem is on the side of certificate agency that doesn't provide API to issue certificates automatically? I don't believe that SO doesn't use some tools like Ansible to automate certificate management on their side. – anatoly techtonik Mar 24 '15 at 3:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .