12

Noticing that the "Human Verification" image did not show, I found that the src, https://sstatic.net/stackoverflow/img/captcha-conchords-robots.jpg, shows that sstatic.net is giving an SSL vertificate for *.stackexchange.com..

  • 2
    To clarify: This is still a bug, but the problem is that the URL for the image is wrong, not that the cert is incorrect. The problem can readily be fixed by the devs using the correct URL. – Martijn Pieters Jul 6 '13 at 11:23
6

The URL should be corrected; the correct URL is:

https://cdn.sstatic.net/stackoverflow/img/captcha-conchords-robots.jpg

which works just fine:

Captcha Conchords Robots

The sstatic.net domain is a named virtual host on the same machine as stackoverflow.com:

$ host sstatic.net
sstatic.net has address 198.252.206.16
$ host stackoverflow.com
stackoverflow.com has address 198.252.206.16
stackoverflow.com mail is handled by 40 stackoverflow.com.s9b2.psmtp.com.
stackoverflow.com mail is handled by 10 stackoverflow.com.s9a1.psmtp.com.
stackoverflow.com mail is handled by 20 stackoverflow.com.s9a2.psmtp.com.
stackoverflow.com mail is handled by 30 stackoverflow.com.s9b1.psmtp.com.

but only one SSL cert can be used per IP address. This is why you see the wrong SSL cert being used.

The cdn.sstatic.net domain is the correct domain for the Stack Exchange CDN.

  • Works without the cdn subdomain as well once you bypass the browser warning. https://sstatic.net/stackoverflow/img/captcha-conchords-robots.jpg is the source used on the SO page. – Mooseman Jul 4 '13 at 11:04
  • 2
    @Mooseman: I know, but the cdn.sstatic.net domain uses the correct SSL cert. The sstatic.net domain is nothing but a virtual host on the same ip address as `stackoverflow.com. – Martijn Pieters Jul 4 '13 at 11:04
  • 1
    So the problem is the source attribute, not the certificate. – Mooseman Jul 4 '13 at 11:15
  • 1
    You got it. :-) – Martijn Pieters Jul 4 '13 at 11:15
  • 2
    "only one SSL cert can be used per IP address" With modern browsers you can use more. I think IE on WinXP is the only notable one that doesn't support SNI. – CodesInChaos Jul 4 '13 at 18:02
  • @CodesInChaos: Right, but until IE on WinXP and Android are sufficiently in the minority, options are limited. – Martijn Pieters Jul 4 '13 at 18:29
  • Thank you for investigating this. – Jarrod Dixon Jul 7 '13 at 0:13
  • 1
    @JarrodDixon Bonus points if you fix(ed) the related issue on Stack Apps! ;) – Tim Stone Jul 7 '13 at 0:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .