Currently, every SE site has two domain names - one for the site itself (
sitename.stackexchange.com) and one for its meta (
meta.sitename.stackexchange.com). This makes it hard to improve HTTPS support network-wide because of the limitations on domain certificates Nick Craver pointed out here.
One of these limitations has a really easy solution (emphasis added):
Section 3.1 of RFC 2818 is very open/ambiguous on wildcard usage, it states:
Names may contain the wildcard character
*which is considered to match any single domain name component or component fragment. E.g.,
It doesn’t really disallow
*.*.meta.stackexchange.com. So far so good…then some jerk tried to make a certificate for
***.com**which obviously wasn’t good, so that was revoked and disallowed. So what happened? Some other jerk went and tried
***.*.com**. Well, that ruined it for everyone. Thanks, jerks.
The rules were further clarified in Section 6.4.3 of RFC 6125 which says (emphasis mine):
The client SHOULD NOT attempt to match a presented identifier in which the wildcard character comprises a label other than the left-most label (e.g., do not match
This means no
meta.*.stackexchange.com. Enough major browsers conform to this RFC that it’s a non-option.
Then why don't we host per-site metas as
sitename.stackexchange.com/meta instead of
meta.sitename.stackexchange.com? That way, we can host all sites and their metas with one single certificate for
I guess most of you have two major concerns on this, so here are solutions to them as well:
This will break existing links to content on child metas, won't it?
HTTP has a built-in for that. As for future sites, the solution is to not even talk about
What about sites that have their own domains?
Since they're not affected by this limitation, there's no need to move the metas of Ask Ubuntu, MathOverflow, Server Fault and Super User. That means we can simply make
/metaredirect to the respective meta of each site.
Stack Apps doesn't even have its own meta.
While Stack Overflow isn't affected either, localized Stack Overflows are affected because their metas' domains look like