1

This is a quite serious bug, rendering all meta SE's useless (in setups similar to mine). I noticed this problem a few days ago and it's still here.

I tested this on meta.bitcoin.SE and meta.math.SE using the latest stable Chrome on Mac.

When doing to the meta page using https, you get following warning:

enter image description here

When proceeding to the https-version, it's possible to login, but not to post questions. For some reason I get a CAPTCHA that fails to load.

When proceeding to the http-version. I log in and the page after the login page shows that I'm logged in, but clicking any link will make me no longer logged in.

If you read this question, it means that it is possible to use the meta.SO, so probably the problem is with meta.XX.SE being a sub-subdomain.

|improve this question
  • I saw this somewhere - the problem is you can't get certificates for meta.*.stackexchange.com. – michaelb958 Jan 29 '14 at 1:54
  • You can get individual ones for *.XX.SE. Is it industry standard that x.x.domain.com is not considered matching *.domain.com? – Steven Roose Jan 29 '14 at 1:58
  • No, the problem is that wildcards only work in the leftmost position, and the alternative is listing each site separately (at 20 or so domains per cert, I can hear the bank accounts screaming). – michaelb958 Jan 29 '14 at 2:03
  • If x.x.domain would just be considered covered by *.domain, there would be no problem. Either way, this has to be fixed because this way, the meta's are not usable. I don't know how they did it before. – Steven Roose Jan 29 '14 at 2:10
  • possible duplicate of Can't login with Stack Exchange OpenID when HTTPS-Everywhere plugin is active - apparent protocol mismatch – Tim Stone Jan 29 '14 at 2:21
  • HTTPS isn't actively supported, true, but I don't think that's a duplicate @TimStone. Same underlying problem (which the tag [ssl] covers), very different symptoms (different enough to warrant a different question). – michaelb958 Jan 29 '14 at 3:48
  • @michaelb958 The underlying problem is HTTPS Everywhere, since without it the OP would have nothing to report. – Tim Stone Jan 29 '14 at 4:39
  • So basically, HTTPS is not supported for sub-subdomains, which is basically all meta's? – Steven Roose Jan 29 '14 at 7:16
  • 2
    You may want to read the blog post Stackoverflow.com: the road to SSL by Nick Craver - he explains the certificate issue there. As others have commented, we can't get a meta.*.stackexchange.com cert or a *.*.stackexchange.com cert. Not because the latter is technically impossible, but because no CA will issue one (years ago someone abused such a certificate and now everyone else has to suffer...). – Oded Jan 29 '14 at 10:16

You must log in to answer this question.

Browse other questions tagged .