# SSL breaks TeX rendering

TeX rendering is broken on sites like Math and Physics when viewed over SSL.

For example:

-
it looks like the adzerk, cdn and imgur stuff don't get switched to https somehow –  rene Jan 8 '14 at 19:49
As far as I can tell the SSL cert of https://cdn.mathjax.org isn't correct, so it's probably not going to be loaded even if they SE changes it. –  slhck Jan 8 '14 at 19:51
The CDN used by MathJax provides an alternative address for https access: https://c328740.ssl.cf1.rackcdn.com/ (see the MathJax FAQ for details). –  Davide Cervone Jan 8 '14 at 21:47
Related bug report on meta.crypto.SE: Bug: MathJax not working due to https/http mixed-content rules and https-everywhere –  Ilmari Karonen Jan 13 '14 at 11:59

## 3 Answers

When accessing one of our MathJax enabled sites via the HTTPS protocol, we now use the CDN specified by the MathJax FAQ:

How do I access the MathJax CDN using a https secure connection?

The MathJax CDN utilizes Rackspace’s CDN service. Unfortunately, this currently does not offer https support for the default address cdn.mathjax.org. However, as an alternative, you can use the following unmapped address:

https://c328740.ssl.cf1.rackcdn.com/mathjax/latest/MathJax.js

While not as appealing as cdn.mathjax.org, this address is stable and safe to use. For more information, see our documentation.

So everyone should now be able to enjoy the beauty of quality mathematics notation whichever protocol they prefer.

-
According to cheap's comment, this has been switched to //mathjax-cdn.storage.googleapis.com/mathjax/... on March 29th? –  Arjan Apr 5 '14 at 10:05
@Arjan It turned out to be an experiment; the URL was switched back next day. –  How About a Nice Big Cup of Apr 5 '14 at 23:00
In the end they switched to //cdn.mathjax.org for both http and https. –  Beni Cherniavsky-Paskin Sep 28 '14 at 17:37

As pointed out by Davide Cervone above, MathJax CDN does support HTTPS as long as you use the hostname c328740.ssl.cf1.rackcdn.com instead of cdn.mathjax.org. Yes, that looks a bit uglier, but that's all "under the hood".

Thus, this bug can be fixed by replacing the URL:

http://cdn.mathjax.org/mathjax/latest/MathJax.js


with:

https://c328740.ssl.cf1.rackcdn.com/mathjax/latest/MathJax.js


on pages served over HTTPS.

Alas, the ugly hostname works only for HTTPS, so protocol-relative URLs can't be used here.

Edit: While waiting for the SE devs to fix this, I managed to find a way to work around the problem with a user script. Basically, the following code will reload MathJax over SSL if it failed to load normally:

if ( 'https:' == location.protocol && 'undefined' === typeof(MathJax) ) {
var mjs = $('script[src^="http://cdn.mathjax.org/"]').remove(); if ( mjs.length > 0 )$.ajax( {
dataType: "script", cache: true,
url: mjs[0].src.replace('http://cdn.mathjax.org', 'https://c328740.ssl.cf1.rackcdn.com')
} );
}


(There are a bunch of tricky little issues here that made this hard to solve, like the fact that MathJax tries to be clever and find its own base URL by searching the DOM for script tags; if the original script tag isn't removed, MathJax will thus try to load its submodules over HTTP and fail.)

I've incorporated this code, along with several other minor fixes, into something I'm calling the Stack Overflow Unofficial Patch. Please give it a try and let me know if you find any issues.

-
Not sure if protocol-relative URLs work anyway. But you can easily embed https content in a page served via http, just not the other way ’round, so just switching to https for MathJax always will work. (Thanks for linking my question with this one here.) –  mirabilos Jan 13 '14 at 16:32
@mirabilos protocol relative URLs do actually work - linking to //example.com/file.js will go to http:// ... if the page is being viewed over http, and https:// ... if viewed over https. However, you're right that just defaulting to the secure version wouldn't be a problem. –  nhinkle Jan 13 '14 at 16:35
@nhinkle It depends how you define "wouldn't be a problem," it's a performance penalty at the very least –  Nick Craver Jan 14 '14 at 16:37
@NickCraver where is the performance penalty? Maybe on the server side, but it's a CDN, so it shouldn't be too much of a problem. On the client side, decoding SSL is a minimal impact. Perhaps due to caching, but how likely is the user to have MathJax cached from another site anyways? Caching can still be done with https, too. Am I missing an aspect? And besides, if the goal is to eventually move Stack Exchange entirely onto https, does it matter if a small portion (MathJax) is moved over early? –  nhinkle Jan 15 '14 at 1:48
@nhinkle HTTPS requires 2 additional round-trips to the termination point on the handshake, for some users that's quite a bit...and the reason SE won't be SSL by default until we have much more local terminations. It's about latency, not processing power, and the penalty is quite large. –  Nick Craver Jan 15 '14 at 1:50
@NickCraver fair enough. In that case, would it be possible to detect the protocol server-side and embed the proper URL? It's a fairly negative user experience to have unrendered LaTeX on the page. –  nhinkle Jan 15 '14 at 3:51
@nhinkle yes it is, I'm concerned about their SSL link though, going to talk to MathJax guys before using it. Some places block some CDNs, this is also a concern, and was a deal breaker with akami for example. Remember that we don't support SSL yet, the negative user experience is by choice. There's still a lot of mixed-content work to be resolved in the coming months. –  Nick Craver Jan 15 '14 at 11:11

For folks who are getting this bug because they're using HTTPS Everywhere, I've pushed a rule to fix this by rewriting the MathJax CDN: https://github.com/EFForg/https-everywhere/commit/a9b1a4cf448d67eb62c869712b778454e902d62a. However, this won't actually fix anything unless you've turned off active mixed content blocking in your browser; Firefox and Chrome have (IMO, incorrectly) implemented mixed content blocking in such a way that the blocker fires before HTTPS Everywhere can rewrite resources to SSL. :(

Firefox bug for reference: https://bugzilla.mozilla.org/show_bug.cgi?id=878890

Ugh! Until that bug is fixed, I would recommend turning off the HTTPS Everywhere rule when you need to TeX (click on the icon in the addons bar, select the "Stack Exchange (partial)" rule to toggle on/off).

PS: This answer should really also go in https-everywhere breaks MathJax due to https/http mixed-content rules but I don't have sufficient reputation to add it there.

-
Seems this works for any site using MathJax, nice. Just in case you missed it: for Stack Exchange, this rule is no longer needed since March 18th. (See the accepted answer.) –  Arjan Apr 5 '14 at 10:02