1

Coming to meta.bicycles.stackexchange.com I am greeted with a "invalid certificate" warning:

certificate warning

Apparently the certificate is valid for *.stackexchange.com, but not for *.*.stackexchange.com: certificate details

At least that's what I understand from here. Shouldn't something be done about it?

| |
3

I don't believe a fix for that is coming any time soon.

According to the SSL certificate standards, only the leftmost component in a certificate can be a wildcard, and the wildcard will not match a ".".

In other words:

  • *.stackexchange.com will match bicycles.stackexchange.com and not meta.bicycles.stackexchange.com.
  • *.*.stackexchange.com would not be a valid cert. (or might only work in some browsers)
  • meta.*.stackexchange.com would not be a valid cert. (or might only work in some browsers)

And, of course, getting a separate "subject alt name" cert for all 115 site metas and redoing the certificate every time a new site is added to the network is too much work to be practical.

More details from one of the Stack Exchange infrastructure people here: http://nickcraver.com/blog/2013/04/23/stackoverflow-com-the-road-to-ssl/

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .