Accessing per-site metas gives 403 forbidden from cloudflare-nginx [closed]

Question

Clicking on https://space.meta.stackexchange.com/ doesn't connect me with the meta S.Ex.SE site.

EDIT: For some entry points, no meta site can be reached. Observation courtesy Gilles.

I consider it a pity that the devs have not paid attention to this issue nor have indicated that they noted the problem. While HTTPS is not yet official on this network, I refrain from using unencrypted connections. I can't participate in metas, oh well.

EDIT #2 (2015-11-07) - with the switch to CloudFlare SSL the problem looks finally resolved.

EDIT #3 (2015-11-17) - still getting 403 Forbidden from CloudFlare. D'rats!..

EDIT #4 (2016-01-11) - We're still there. It's 2016 already... Starting a bounty.

Answer 1

This is a result/side-effect of some changes Cloudflare made recently, but the fact of the matter is that we'd run into problems with HTTPS support on child meta sites eventually anyway: you can't have a wildcard in the middle of a cert, so meta.*.stackexchange.com could never be a thing and we're not about to start registering/maintaining 100+ certs.

So. We're working on moving meta sites to a different URL scheme (*.meta.stackexchange.com) to get around this. It's a move that was planned earlier, but was held back by universal login... which is now functionally complete. Unfortunately, there's a bunch of other stuff going on at the same time, so this switch is unlikely to happen until late October.

In the meantime, I suggest not using HTTPS on meta sites since it's technically unsupported anyway.

Answer 2

CloudFlare seems to have repaired its nginx. Closing as "probably fixed". Will reopen if the bug recurs.

Repro'ed by Gilles:

Still failing for me with all meta.*.stackexchange.com over HTTPS. I guess only some of their infrastructure is broken and we're hitting different entry points. - Gilles (here)

Just repro'ed by myself at Earth Sciences SE meta.

...And repro'ed again at Meta IT Sec.SE

September 16 — still a problem. I can use meta on my phone, but that's a kludge.

September 22 — suffering. Adding a smallish bounty for the fun of it, hoping that someone may shed light on the issue.

October 5 — Stack Exchange Inc. must have switched back to old pre-Cloudflare certs and seems to serve pages directly. Metas suddenly work.

November 7 — The switch to CloudFlareSSL fixed the problem (here's hoping).

November 17 — Aaand CloudFlare strikes again. 403 Forbidden error, and the certs don't have the requisite SANs for metas.

On Christmas Eve — my true love did not give me 12 TLS certificates, 11 A+ Qualys assessments, etc. etc. but only one 403 Forbidden for each meta site except stackoverflow, serverfault, askubuntu, and MSE.

Answer 3

HTTPS was usable on per-site metas on third-level domains (i.e. meta.*.stackexchange.com) at some point if you were willing to accept a mismatched certificate, but these days they're blocked inside Cloudflare. Sigh

All accesses to the Stack Exchange API use HTTPS, so anything that can be done through the API (documented or undocumented) can be done over HTTPS.

On a PC-style computer (or a mobile device if you really want, but Emacs without a physical keyboard isn't really comfortable), you can use Stack Exchange for Emacs, available as the package sx on ELPA. Here are the main things you can and cannot do:

• View question lists (front page, newest, unanswered, etc., and per-tag lists)
• View question pages. Markdown is pretty-printed (but without code highlighting), images are visible, but MathJax is displayed in source form.
• Post comments and upvote them.
• Post, edit and vote on questions and answers (including suggesting an edit and creating tags).
• Mark a question as a favorite.
• Read your inbox.
• Mark questions as read (that mark is only visible in the Emacs app).
• You cannot perform moderation-related activitives such as flagging, closing, reviewing or handling flags.
• You can only have one question list and one question page open at a time. However, there's a workaround for that: M-: (setq sx-question-mode--buffer nil) RET makes SX forget the current question buffer, so that if you select another question in a list, it'll be opened in a new buffer. This also works for question lists, with variables like sx-tab--all-questions-buffer.
• There's no way to access tag wikis.
• Visiting through an unofficial app does not count as a visit for “last seen” dates and badges.

That's what I use to access meta sites on my laptop when I'm on the go. (I use plain HTTP at home but not when I'm on an untrusted connection such as a hotel, café, etc.)

Another possibility is to use the Android app (which you can use on a PC inside the Android Emulator. The user interface sucks, but it has some features that aren't available in the Emacs app (some of which can't be done through the documented API):

• MathJax is supported.
• You can flag posts and comments and vote to close, but not (vote to) delete or reopen.
• You can only see one screen at a time, there's no easy way to switch between questions let alone between sites, and you can't open two questions at a time.
• There's no way to access tag wikis.
• You can view user profiles.
• Visiting through an official app counts as a visit for “last seen” dates and badges.