0

This question already has an answer here:

The usual decision when the host name and the name in the certificate don't match is to reject the certificate. I see no reason to desensitize users to Man-in-the-Middle attacks by telling them: "it's okay to accept a certificate although the names don't match".

EDIT:

I have Firefox Cert Patrol extension installed. Yes, I have read the alt names, but not everybody does that. Scaring a user away out of desire to save money on certs isn't a good tactic, IMHO.

EDIT #2: As reported by Carlos Campderrós (and observed by me now), the name mismatch is definitely encountered without any alternative names on https://stackoverflow.com.

marked as duplicate by animuson Sep 23 '13 at 15:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    I'm pretty sure the motivation behind this isn't saving money :) – Tim Post Sep 4 '13 at 14:10
  • 2
    If cert is OK (and it is), then it is faulty extension that scares users, not Stack Exchange. Tell them it's unfair. I mean, really, you should post a bugreport. – Mołot Sep 20 '13 at 13:34
  • 2
    This question appears to be off-topic because it is about a bug of a Firefox extension. – Hugo Dozois Sep 20 '13 at 13:39
  • 1
    BTW the certificate on stackoverflow.com is invalid for my firefox 24.0 (on Fedora 19), with only Firebug, WebDeveloper toolbar and eventbug installed as addons. Examining the certificate it shows the altNames: *.stackexchange.com stackexchange.com only. The same happens with Google Chrome 29.0.1547.76 – Carlos Campderrós Sep 23 '13 at 13:55
  • @CarlosCampderrós - something weird goes on; the same here. – Deer Hunter Sep 23 '13 at 14:32
  • @CarlosCampderrós remember, SSL is not an officially supported feature yet (as far as I know). Your milage may vary. Just because its available doesn't mean it will always work. – Steven V Sep 23 '13 at 15:16
11

Under the subject alternative names on the certificate that is issued to Stack Exchange:

DNS Name=*.stackexchange.com
DNS Name=stackexchange.com
DNS Name=meta.stackexchange.com
DNS Name=*.meta.stackexchange.com
DNS Name=*.stackoverflow.com
DNS Name=stackoverflow.com
DNS Name=serverfault.com
DNS Name=stackauth.com
DNS Name=sstatic.net
DNS Name=meta.serverfault.com
DNS Name=superuser.com
DNS Name=meta.superuser.com
DNS Name=stackapps.com
DNS Name=openid.stackauth.com

All of these domains would be valid SSL certificate domains. stackapps.com is one of the accepted domains, and you shouldn't be getting a certificate warning for visiting https://stackauth.com.

  • 1
    I do get a warning - I have Firefox Cert Patrol extension installed. Yes, I have read the alt names, but not everybody does that. Scaring a user away out of desire to save money on certs isn't a good tactic, IMHO. – Deer Hunter Sep 4 '13 at 13:11
  • 3
    @DeerHunter I'm not speaking for the admins here. I have a feeling the extension will land in the "unsupported" realm. It works in the supported browsers for me. – Steven V Sep 4 '13 at 13:14
  • Thanks for the clarifications. – Deer Hunter Sep 4 '13 at 13:15
  • 11
    @DeerHunter For what it's worth, it sounds like you found a bug (or feature request?) for the Firefox extension. Having that field displayed to the end user in certain circumstances, like this one, seems like a good idea. – Steven V Sep 4 '13 at 13:19
  • 1
    @DeerHunter this wasn't a money saving decision at all, it's consolidation of certificates given IPv4 address space availability and how our load balancer architecture is laid out. Compared to standard certificates, it's actually quite a pain in the ass to update this certificate since it involves manual intervention by our CA and is not self-serve. – Nick Craver Sep 23 '13 at 15:13

Not the answer you're looking for? Browse other questions tagged .