1

Currently, every SE site has two domain names - one for the site itself (sitename.stackexchange.com) and one for its meta (meta.sitename.stackexchange.com). This makes it hard to improve HTTPS support network-wide because of the limitations on domain certificates Nick Craver pointed out here.

One of these limitations has a really easy solution (emphasis added):

Section 3.1 of RFC 2818 is very open/ambiguous on wildcard usage, it states:

Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.

It doesn’t really disallow meta.*.stackexchange.com or *.*.meta.stackexchange.com. So far so good…then some jerk tried to make a certificate for ***.com** which obviously wasn’t good, so that was revoked and disallowed. So what happened? Some other jerk went and tried ***.*.com**. Well, that ruined it for everyone. Thanks, jerks.

The rules were further clarified in Section 6.4.3 of RFC 6125 which says (emphasis mine):

The client SHOULD NOT attempt to match a presented identifier in which the wildcard character comprises a label other than the left-most label (e.g., do not match bar.*.example.net)

This means no *.*.stackexchange.com or meta.*.stackexchange.com. Enough major browsers conform to this RFC that it’s a non-option.

Then why don't we host per-site metas as sitename.stackexchange.com/meta instead of meta.sitename.stackexchange.com? That way, we can host all sites and their metas with one single certificate for *.stackexchange.com.


I guess most of you have two major concerns on this, so here are solutions to them as well:

  1. This will break existing links to content on child metas, won't it?

    HTTP has a built-in for that. As for future sites, the solution is to not even talk about meta.sitename.stackexchange.com.

  2. What about sites that have their own domains?

    Since they're not affected by this limitation, there's no need to move the metas of Ask Ubuntu, MathOverflow, Server Fault and Super User. That means we can simply make /meta redirect to the respective meta of each site.

    Stack Apps doesn't even have its own meta.

    While Stack Overflow isn't affected either, localized Stack Overflows are affected because their metas' domains look like meta.*.stackoverflow.com.

closed as off-topic by TRiG is Timothy Richard Green, Glorfindel, S.L. Barth, ale, Robert Longson Jun 23 '17 at 13:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "The problem described here can no longer be reproduced. Changes to the system or to the circumstances affecting the asker have rendered it obsolete. If you encounter a similar problem, please post a new question." – TRiG is Timothy Richard Green, Glorfindel, S.L. Barth, ale, Robert Longson
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    This is not necessary. We're already moving to the *.meta.stackexchange.com to solve the HTTPS problem. It's being actively worked on. – animuson Sep 8 '16 at 23:37
6

Adam Lear says they already have plans in motion for SSL:

I can tell you that it's being worked on (next step: moving meta sites to the *.meta.stackexchange.com URL scheme from meta.*.stackexchange.com), but there is no deadline or ETA. We're solving issues, paying down tech debt as needed, and making progress as time allows amidst everything else that's currently in progress.

Not the answer you're looking for? Browse other questions tagged .