3

After the conversion of all outgoing links to HTTPS, I now get this error.

enter image description here

I get that error for, near as I can tell, for any page rooted at http://stackexchange.com/ but not for subdomains, such as http://meta.stackexchange.com/. The offending source is <script src="https://edge.quantserve.com/quant.js"></script>. (around line 1345 for the home page.) This only shows up in my Konqueror browser, which seems to be stricter than Firefox, which doesn't complain when loading the SE pages, but does give and error if I directly load the offending URL. (Possible bug, or security issue with Firefox.) Interestingly enough, that tag is absent in the HTTPS version of the same pages, so I don't know how it would respond when the browser is supposed to check the page for mixed content.

Retrieving the certificate offered from that URL yields

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            63:b9:ec:7e:ff:98:83:35:f1:13:d6:7d:2f:86:4d:35
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 ECC 256 bit SSL CA - G2
        Validity
            Not Before: Jul 28 00:00:00 2016 GMT
            Not After : Jul 28 23:59:59 2017 GMT
        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Akamai Technologies, Inc., CN=a248.e.akamai.net
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub: 
                    04:02:a6:fc:13:cd:66:f5:ba:aa:2c:a8:4e:76:22:
                    d3:ee:90:7e:b3:61:bc:75:1a:3b:d3:c7:80:60:1c:
                    6b:a5:45:d8:2d:f6:9b:27:1f:26:cb:2e:fe:34:e2:
                    35:d2:9a:dd:4a:92:2b:4f:eb:19:a8:90:10:38:a9:
                    bd:47:66:74:2b
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:*.akamaihd.net, DNS:*.akamaihd-staging.net, DNS:*.akamaized-staging.net, DNS:*.akamaized.net, DNS:a248.e.akamai.net
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.2
                CPS: https://d.symcb.com/cps
                User Notice:
                    Explicit Text: https://d.symcb.com/rpa

            X509v3 CRL Distribution Points: 

                Full Name:
                URI:http://rc.symcb.com/rc.crl

            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier: 
                keyid:25:F0:8A:E1:4B:7A:D9:01:95:0A:ED:C6:53:F1:8C:78:1F:D9:F3:F8

            Authority Information Access: 
                OCSP - URI:http://rc.symcd.com
                CA Issuers - URI:http://rc.symcb.com/rc.crt

            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : DD:EB:1D:2B:7A:0D:4F:A6:20:8B:81:AD:81:68:70:7E:
                                2E:8E:9D:01:D5:5C:88:8D:3D:11:C4:CD:B6:EC:BE:CC
                    Timestamp : Jul 28 20:05:03.628 2016 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:D2:39:E1:01:CD:38:CA:D3:2A:C1:CA:
                                73:76:17:A9:0E:89:71:93:8F:CB:CB:4D:73:ED:36:F3:
                                86:B7:44:9B:AF:02:20:30:68:AA:47:C7:79:47:FF:12:
                                0C:B8:0D:CE:96:B4:5E:DD:E1:86:B3:E9:54:30:B4:F6:
                                6D:13:AD:A7:62:86:D6
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : A4:B9:09:90:B4:18:58:14:87:BB:13:A2:CC:67:70:0A:
                                3C:35:98:04:F9:1B:DF:B8:E3:77:CD:0E:C8:0D:DC:10
                    Timestamp : Jul 28 20:05:03.721 2016 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:B6:6B:FF:58:30:04:90:8C:CF:A0:09:
                                8D:83:CA:C3:07:78:71:8E:BA:83:13:6F:0E:F7:2A:5C:
                                1D:F2:DF:0C:A4:02:20:09:1E:C7:3B:65:B2:5A:3D:BE:
                                F8:3C:F1:DA:DA:1C:B0:05:9F:A2:DE:84:E2:9A:F8:20:
                                E6:1B:EE:E2:06:C8:52
    Signature Algorithm: ecdsa-with-SHA256
        30:45:02:21:00:9a:2c:bc:7b:38:29:8e:52:13:60:a1:95:ff:
        b3:aa:72:1b:31:38:a7:97:45:88:b2:49:9b:7b:ba:74:3c:3f:
        8d:02:20:4b:cb:c1:d5:16:5e:bd:ec:9c:84:c6:d7:0c:fa:f1:
        e7:2f:d6:1e:f7:cf:cb:19:42:92:f1:d0:47:d4:d7:d7:9a

I don't know if the URL is co-owned with the subject of the certificate or not, but I'm not adding exceptions for miss-configured servers.

I realize that this is part of the overall migration to HTTPS for SE site-wide, and I expect that there will be other problems/bug to track down. In that vein, I'm not complaining about the error. Rather, I'm raising it so that the developers can track down problems and correct them. In this case it probably involves getting the third-party site to correct their issues.

This seemed like the best place to raise the issue. If it's better raised elsewhere, please tell me where and I can post it there instead.

  • In Chrome I only get this error in the dev console, but yeah something is broken in there. Thanks for the report! :) – ShaWiz Mar 9 '17 at 9:53
  • The website whynopadlock.com shows a large number of HTTP assets on that page. – TRiG is Timothy Richard Green Mar 9 '17 at 10:20
  • 1
    @TRiGisTimothyRichardGreen The items found are links not yet converted to HTTPS on the HTTPS version of the home page. All are Gravatar images. The problem here is on the HTTP pages with a link that is HTTPS, but that serves an invalid certificate. It's a problem SE will have to get that site to fix. Because it's part of their metrics, I believe, it's also a link they can't "just drop" to avoid page load errors. SE needs it to work for their benefit, not mine. It has to be fixed - at the source, not on SE - so the sooner they know, the longer they have to get the other site to fix it. – Gypsy Spellweaver Mar 9 '17 at 10:35
1

This should behave correctly in the latest version of all sites - we're https:// across the board with Q&A now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .