This is a quite serious bug, rendering all meta SE's useless (in setups similar to mine). I noticed this problem a few days ago and it's still here.

I tested this on meta.bitcoin.SE and meta.math.SE using the latest stable Chrome on Mac.

When doing to the meta page using https, you get following warning:

enter image description here

When proceeding to the https-version, it's possible to login, but not to post questions. For some reason I get a CAPTCHA that fails to load.

When proceeding to the http-version. I log in and the page after the login page shows that I'm logged in, but clicking any link will make me no longer logged in.

If you read this question, it means that it is possible to use the meta.SO, so probably the problem is with meta.XX.SE being a sub-subdomain.

  • I saw this somewhere - the problem is you can't get certificates for meta.*.stackexchange.com. Jan 29, 2014 at 1:54
  • You can get individual ones for *.XX.SE. Is it industry standard that x.x.domain.com is not considered matching *.domain.com? Jan 29, 2014 at 1:58
  • No, the problem is that wildcards only work in the leftmost position, and the alternative is listing each site separately (at 20 or so domains per cert, I can hear the bank accounts screaming). Jan 29, 2014 at 2:03
  • If x.x.domain would just be considered covered by *.domain, there would be no problem. Either way, this has to be fixed because this way, the meta's are not usable. I don't know how they did it before. Jan 29, 2014 at 2:10
  • HTTPS isn't actively supported, true, but I don't think that's a duplicate @TimStone. Same underlying problem (which the tag [ssl] covers), very different symptoms (different enough to warrant a different question). Jan 29, 2014 at 3:48
  • @michaelb958 The underlying problem is HTTPS Everywhere, since without it the OP would have nothing to report.
    – Tim Stone
    Jan 29, 2014 at 4:39
  • So basically, HTTPS is not supported for sub-subdomains, which is basically all meta's? Jan 29, 2014 at 7:16
  • 2
    You may want to read the blog post Stackoverflow.com: the road to SSL by Nick Craver - he explains the certificate issue there. As others have commented, we can't get a meta.*.stackexchange.com cert or a *.*.stackexchange.com cert. Not because the latter is technically impossible, but because no CA will issue one (years ago someone abused such a certificate and now everyone else has to suffer...).
    – Oded
    Jan 29, 2014 at 10:16


You must log in to answer this question.

Browse other questions tagged .