# Accessing per-site metas gives 403 forbidden from cloudflare-nginx [closed]

Clicking on https://space.meta.stackexchange.com/ doesn't connect me with the meta S.Ex.SE site.

EDIT: For some entry points, no meta site can be reached. Observation courtesy Gilles.

I consider it a pity that the devs have not paid attention to this issue nor have indicated that they noted the problem. While HTTPS is not yet official on this network, I refrain from using unencrypted connections. I can't participate in metas, oh well.

EDIT #2 (2015-11-07) - with the switch to CloudFlare SSL the problem looks finally resolved.

EDIT #3 (2015-11-17) - still getting 403 Forbidden from CloudFlare. D'rats!..

EDIT #4 (2016-01-11) - We're still there. It's 2016 already... Starting a bounty.

## closed as off-topic by Ilmari Karonen, Ward, Anthony Pham, Glorfindel, M.A.R.Aug 23 '16 at 18:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

• "The problem described here can no longer be reproduced. Changes to the system or to the circumstances affecting the asker have rendered it obsolete. If you encounter a similar problem, please post a new question." – Ilmari Karonen, Ward, Anthony Pham, Glorfindel, M.A.R.
If this question can be reworded to fit the rules in the help center, please edit the question.

• Reproed. They don't want you to do meta in the space. – M.A.R. Sep 7 '15 at 10:35
• I get a certificate error/warning, without ssl all is fine... – rene Sep 7 '15 at 10:35
• meta.space.stackexchange.com works although meta.space.stackexchange.com doesn't. – Spikatrix Sep 7 '15 at 10:36
• @CoolGuy - I don't use plain HTTP with Stack Exchange any more... – Deer Hunter Sep 7 '15 at 10:44
• @inɒzɘmɒЯ.A.M - they don't want me to do meta S.Ex. In space. – Deer Hunter Sep 7 '15 at 10:45
• SE still does not support https. Until they do (might take long years) we can browse the http:// version. – Shadow The Princess Wizard Sep 7 '15 at 10:48
• @ShadowWizard - Officially, there's no switch to full-throttle TLS. De facto, there's a choice, and I choose HTTPS for obvious reasons. – Deer Hunter Sep 7 '15 at 10:51
• Your choice, but what I'm saying is that bugs and things that don't work are expected. – Shadow The Princess Wizard Sep 7 '15 at 10:51
• Still failing for me with all meta.*.stackexchange.com over HTTPS. I guess only some of their infrastructure is broken and we're hitting different entry points. – Gilles 'SO- stop being evil' Sep 7 '15 at 15:20
• @Gilles - okay, voting to reopen. – Deer Hunter Sep 7 '15 at 15:24
• Voted to re-open. While https is not officially supported it is being rolled out and worked on, and this is a genuine problem. So I suggest we leave it up to devs/staff to decide if this can be fixed, is already in the todo, or whatever. – James Sep 7 '15 at 15:53
• Interesting, when logged out it's not giving any errors, only when logged in. So it's not disruptive. (i.e.we can login) – Shadow The Princess Wizard Nov 17 '15 at 11:04
• In the meantime, you can use the Android app (good for reading, posting, commenting, voting and closing, but not for editing because it tends to lose edits if you switch out of it), the iOS app (like the Android app I assume, maybe plus editing), or the Emacs app (good for reading, posting, editing and voting, but no closing). – Gilles 'SO- stop being evil' Jan 11 '16 at 12:21
• @DeerHunter Oh, well, whatever. It's not as if I needed a bounty on MSE. – Gilles 'SO- stop being evil' Jan 18 '16 at 13:20
• They just made the shift from Cloudflare to Fastly, and I'm no longer getting these errors using https. – HDE 226868 Jun 6 '16 at 23:57

This is a result/side-effect of some changes Cloudflare made recently, but the fact of the matter is that we'd run into problems with HTTPS support on child meta sites eventually anyway: you can't have a wildcard in the middle of a cert, so meta.*.stackexchange.com could never be a thing and we're not about to start registering/maintaining 100+ certs.

So. We're working on moving meta sites to a different URL scheme (*.meta.stackexchange.com) to get around this. It's a move that was planned earlier, but was held back by universal login... which is now functionally complete. Unfortunately, there's a bunch of other stuff going on at the same time, so this switch is unlikely to happen until late October.

In the meantime, I suggest not using HTTPS on meta sites since it's technically unsupported anyway.

• What will happen to all meta.*.stackexchange.com links? Will they redirect (and be unsecure) or auto edited, or something else? – Tim Sep 26 '15 at 10:44
• @Tim Most likely a mix of both. We can rewrite the links we control, and redirect the rest. – Adam Lear Sep 26 '15 at 22:28
• Late October of what year? – Gilles 'SO- stop being evil' Nov 27 '15 at 13:05
• @Gilles Hopefully one in this century. – Adam Lear Nov 27 '15 at 18:24
• Seriously, though, I'm not sure what happened to plans on this. I'll ask around. – Adam Lear Nov 27 '15 at 18:26
• Late december is coming, so most likely @Gilles was right on spot. 6-8 Octobers, perhaps? ;) – Shadow The Princess Wizard Dec 24 '15 at 11:44
• @ShadowWizard If it was 6-8 months it'd be right around the corner. – E.P. Apr 27 '16 at 12:11
• @E.P. but it's not. I don't care that it takes so long. I do care being ignored. "it was delayed to 2021" will be better than just ignoring comments asking for updates. Oh well. – Shadow The Princess Wizard Apr 27 '16 at 13:17
• @ShadowWizard It's still on the radar. It hasn't been forgotten. There is no schedule or estimate. – Adam Lear Apr 27 '16 at 13:19
• Thanks @Adam - guess no reply means "no schedule or estimate" in other cases as well. – Shadow The Princess Wizard Apr 27 '16 at 13:20
• FWIW, still broken. See meta.ux.stackexchange.com/questions/2089/… – RockPaperLizard May 21 '16 at 22:28

CloudFlare seems to have repaired its nginx. Closing as "probably fixed". Will reopen if the bug recurs.

Repro'ed by Gilles:

Still failing for me with all meta.*.stackexchange.com over HTTPS. I guess only some of their infrastructure is broken and we're hitting different entry points. - Gilles (here)

Just repro'ed by myself at Earth Sciences SE meta.

...And repro'ed again at Meta IT Sec.SE

September 16 — still a problem. I can use meta on my phone, but that's a kludge.

September 22 — suffering. Adding a smallish bounty for the fun of it, hoping that someone may shed light on the issue.

October 5 — Stack Exchange Inc. must have switched back to old pre-Cloudflare certs and seems to serve pages directly. Metas suddenly work.

November 7 — The switch to CloudFlareSSL fixed the problem (here's hoping).

November 17 — Aaand CloudFlare strikes again. 403 Forbidden error, and the certs don't have the requisite SANs for metas.

On Christmas Eve — my true love did not give me 12 TLS certificates, 11 A+ Qualys assessments, etc. etc. but only one 403 Forbidden for each meta site except stackoverflow, serverfault, askubuntu, and MSE.

HTTPS was usable on per-site metas on third-level domains (i.e. meta.*.stackexchange.com) at some point if you were willing to accept a mismatched certificate, but these days they're blocked inside Cloudflare. Sigh

All accesses to the Stack Exchange API use HTTPS, so anything that can be done through the API (documented or undocumented) can be done over HTTPS.

On a PC-style computer (or a mobile device if you really want, but Emacs without a physical keyboard isn't really comfortable), you can use Stack Exchange for Emacs, available as the package sx on ELPA. Here are the main things you can and cannot do:

• View question lists (front page, newest, unanswered, etc., and per-tag lists)
• View question pages. Markdown is pretty-printed (but without code highlighting), images are visible, but MathJax is displayed in source form.
• Post comments and upvote them.
• Post, edit and vote on questions and answers (including suggesting an edit and creating tags).
• Mark a question as a favorite.
• Mark questions as read (that mark is only visible in the Emacs app).
• You cannot perform moderation-related activitives such as flagging, closing, reviewing or handling flags.
• You can only have one question list and one question page open at a time. However, there's a workaround for that: M-: (setq sx-question-mode--buffer nil) RET makes SX forget the current question buffer, so that if you select another question in a list, it'll be opened in a new buffer. This also works for question lists, with variables like sx-tab--all-questions-buffer.
• There's no way to access tag wikis.
• Visiting through an unofficial app does not count as a visit for “last seen” dates and badges.

That's what I use to access meta sites on my laptop when I'm on the go. (I use plain HTTP at home but not when I'm on an untrusted connection such as a hotel, café, etc.)

Another possibility is to use the Android app (which you can use on a PC inside the Android Emulator. The user interface sucks, but it has some features that aren't available in the Emacs app (some of which can't be done through the documented API):

• MathJax is supported.
• You can flag posts and comments and vote to close, but not (vote to) delete or reopen.
• You can only see one screen at a time, there's no easy way to switch between questions let alone between sites, and you can't open two questions at a time.
• There's no way to access tag wikis.
• You can view user profiles.
• Visiting through an official app counts as a visit for “last seen” dates and badges.