Bug report for conversion to SSL

Question

After the conversion of all outgoing links to HTTPS, I now get this error.

I get that error for, near as I can tell, for any page rooted at http://stackexchange.com/ but not for subdomains, such as http://meta.stackexchange.com/. The offending source is <script src="https://edge.quantserve.com/quant.js"></script>. (around line 1345 for the home page.) This only shows up in my Konqueror browser, which seems to be stricter than Firefox, which doesn't complain when loading the SE pages, but does give and error if I directly load the offending URL. (Possible bug, or security issue with Firefox.) Interestingly enough, that tag is absent in the HTTPS version of the same pages, so I don't know how it would respond when the browser is supposed to check the page for mixed content.

Retrieving the certificate offered from that URL yields

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:b9:ec:7e:ff:98:83:35:f1:13:d6:7d:2f:86:4d:35
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 ECC 256 bit SSL CA - G2
        Validity
            Not Before: Jul 28 00:00:00 2016 GMT
            Not After : Jul 28 23:59:59 2017 GMT
        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Akamai Technologies, Inc., CN=a248.e.akamai.net
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub: 
                    04:02:a6:fc:13:cd:66:f5:ba:aa:2c:a8:4e:76:22:
                    d3:ee:90:7e:b3:61:bc:75:1a:3b:d3:c7:80:60:1c:
                    6b:a5:45:d8:2d:f6:9b:27:1f:26:cb:2e:fe:34:e2:
                    35:d2:9a:dd:4a:92:2b:4f:eb:19:a8:90:10:38:a9:
                    bd:47:66:74:2b
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:*.akamaihd.net, DNS:*.akamaihd-staging.net, DNS:*.akamaized-staging.net, DNS:*.akamaized.net, DNS:a248.e.akamai.net
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.2
                CPS: https://d.symcb.com/cps
                User Notice:
                    Explicit Text: https://d.symcb.com/rpa

            X509v3 CRL Distribution Points: 

                Full Name:
                URI:http://rc.symcb.com/rc.crl

            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier: 
                keyid:25:F0:8A:E1:4B:7A:D9:01:95:0A:ED:C6:53:F1:8C:78:1F:D9:F3:F8

            Authority Information Access: 
                OCSP - URI:http://rc.symcd.com
                CA Issuers - URI:http://rc.symcb.com/rc.crt

            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : DD:EB:1D:2B:7A:0D:4F:A6:20:8B:81:AD:81:68:70:7E:
                                2E:8E:9D:01:D5:5C:88:8D:3D:11:C4:CD:B6:EC:BE:CC
                    Timestamp : Jul 28 20:05:03.628 2016 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:D2:39:E1:01:CD:38:CA:D3:2A:C1:CA:
                                73:76:17:A9:0E:89:71:93:8F:CB:CB:4D:73:ED:36:F3:
                                86:B7:44:9B:AF:02:20:30:68:AA:47:C7:79:47:FF:12:
                                0C:B8:0D:CE:96:B4:5E:DD:E1:86:B3:E9:54:30:B4:F6:
                                6D:13:AD:A7:62:86:D6
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : A4:B9:09:90:B4:18:58:14:87:BB:13:A2:CC:67:70:0A:
                                3C:35:98:04:F9:1B:DF:B8:E3:77:CD:0E:C8:0D:DC:10
                    Timestamp : Jul 28 20:05:03.721 2016 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:B6:6B:FF:58:30:04:90:8C:CF:A0:09:
                                8D:83:CA:C3:07:78:71:8E:BA:83:13:6F:0E:F7:2A:5C:
                                1D:F2:DF:0C:A4:02:20:09:1E:C7:3B:65:B2:5A:3D:BE:
                                F8:3C:F1:DA:DA:1C:B0:05:9F:A2:DE:84:E2:9A:F8:20:
                                E6:1B:EE:E2:06:C8:52
    Signature Algorithm: ecdsa-with-SHA256
        30:45:02:21:00:9a:2c:bc:7b:38:29:8e:52:13:60:a1:95:ff:
        b3:aa:72:1b:31:38:a7:97:45:88:b2:49:9b:7b:ba:74:3c:3f:
        8d:02:20:4b:cb:c1:d5:16:5e:bd:ec:9c:84:c6:d7:0c:fa:f1:
        e7:2f:d6:1e:f7:cf:cb:19:42:92:f1:d0:47:d4:d7:d7:9a

I don't know if the URL is co-owned with the subject of the certificate or not, but I'm not adding exceptions for miss-configured servers.

I realize that this is part of the overall migration to HTTPS for SE site-wide, and I expect that there will be other problems/bug to track down. In that vein, I'm not complaining about the error. Rather, I'm raising it so that the developers can track down problems and correct them. In this case it probably involves getting the third-party site to correct their issues.

This seemed like the best place to raise the issue. If it's better raised elsewhere, please tell me where and I can post it there instead.

Answer 1

This should behave correctly in the latest version of all sites - we're https:// across the board with Q&A now.