8

Yes, there is HTTPS available.

When browsing any StackExchange site, my Firefox console displays this warning:

This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.

To be clear, it's not the SE cert that is at fault, but the CA root certificate.

The warning points to Weak Signature Algorithm for more information.

Whether one chooses to connect via https or not, this is a concern because of mixed content on the sites, and because the GlobalSign Root CA certificate that is the root for *.stackexchange.com has a weak or insecure signature (SHA1 with RSA). That can currently result in a visible warning, depending on which browser is used. Today, actual functionality is unaffected, but should be expected over time.

  • (Microsoft) "...expect SHA1 certificates issued after 1/1/2017 may stop working at any time." Internet Explorer will distrust SHA-1 certificates after 2016.
  • (Mozilla) Same timeline.
  • (Chrome) Is actively sunsetting SHA-1 support. Sites with end-entity (“leaf”) certificates that expire on or after 1 January 2017, and which include a SHA-1-based signature as part of the certificate chain, will be treated as “secure, but with minor errors”. That refers to SE, currently.

Will you be upgrading to more secure certificates at next renewal?

Improve this question
  • 2
    Stack Exchange doesn't yet have https version, so can't see any reason for them to upgrade something that doesn't exist. – Shadow Wizard is Vaccinating Jul 7 '15 at 14:32
  • 2
    @ShadowWizard Say what? – cpast Jul 7 '15 at 14:36
  • 1
    @cpast it works by chance. Many things don't work since they link to resources using http:// protocol. Once upon a time, it worked - these days, modern browsers block those resources hence stuff breaks. – Shadow Wizard is Vaccinating Jul 7 '15 at 14:38
  • Your edit makes your question not relevant for Chrome users, who get a totally different reason: i.stack.imgur.com/vIaMz.png (upgrading won't help, SE developers need to change the code to "fix" it) - tagging it as firefox only question. – Shadow Wizard is Vaccinating Jul 7 '15 at 14:44
  • We have SSL, just not for everything (thus it isn't officially supported, even though we do our best to make sure it works well enough to use stuff if you use it). When it's fully supported, I believe we're going to be using the best extended-validation certs we can get. – Tim Post Jul 7 '15 at 14:44
  • @ShadowWizard - nuh-uh, adding a screenshot of the warning from chrome does not make the question ff-specific, nor irrelevant to chrome users, given that it simply illustrates that you can connect via HTTPS, which you claimed didn't exist. The fact is that SE has subscribed to certificates which are shipped to browsers whether or not HTTPS is officially supported, and the certificate chain is insecure. Major browser providers are heading towards fully distrusting those certs in 18 months or less. – Mogsdad Jul 7 '15 at 15:22
  • This is not a duplicate. That question discusses HTTPS in general, this question is about SHA-1 specifically. – DeadMG Jan 16 '16 at 11:51

You must log in to answer this question.

Browse other questions tagged .