9

Visiting https://meta.security.stackexchange.com displays an HTTPS certificate error in Google Chrome and Internet Explorer 10.

For reference, meta.<sitename>.stackexchange.com is the old URL for per-site metas. Child metas were migrated to <sitename>.meta.stackexchange.com during the implementation of network-wide HTTPS support. The old URLs were configured to silently redirect users to the correct page.

This issue has technically been reported a few times before, (1, 2, 3, 4, 5). However, these reports were made before HTTPS support for child metas was officially completed in March 2017.

Security error for meta.security.stackexchange.com

Improve this question
5
  • Not really a bug, not on SE side at least, unless you find a link inside SE which points to such URL. Those links should be fixed from their source.
    – Shadow Wizard
    Commented Jul 31, 2017 at 14:49
  • The old meta url will still produce error. Use the new url
    – Optimus Prime
    Commented Jul 31, 2017 at 14:49
  • 5
    @animuson is it status declined or status bydesign?
    – Optimus Prime
    Commented Jul 31, 2017 at 14:50
  • 2
    @SagarV - both. Both is good.
    – Oded StaffMod
    Commented Jul 31, 2017 at 14:51
  • 2
    Both is not good. "Won't fix" and "There is nothing to fix because this is by design" are orthogonal. This is issue tracking 101...
    – Asteroids With Wings
    Commented Dec 23, 2020 at 22:38

3 Answers 3

Reset to default
3

HTTPS redirects (from https://meta.*.stackexchange.com to https://*.meta.stackexchange.com) now work. While fixing HTTPS wasn’t the goal (and we've said in the past that it wasn't worth fixing), a change in our internal architecture made it easy to fix, so we fixed it.

See my answer here for more details.

Improve this answer
10

The old Meta URLs will never support HTTPS. The whole point of changing the path to *.meta.stackexchange.com was because wildcards cannot use meta.*.stackexchange.com and we couldn't apply a single certificate to all of the Meta domains. We are not interested in maintaining a bunch of certificates for all the domains just to support an outdated URL scheme that was replaced for the very reason we couldn't support it.

Since we now automatically redirect users to the secure version of the site, using an old URL will already get them to the new, secure version of the page via a redirect.

Improve this answer
9

Actually, going to http://meta.security.stackexchange.com redirects. However, https://meta.security.stackexchange.com does not have a certificate, which is why you are seeing that screen.

The whole point of moving the scheme to meta.<sitename>.stackexchange.com was to reduce the maintenance costs of certificates (given that a *.*.stackexchange.com certificate is not obtainable, nor can a meta.*.stackexchange.com one, but a *.meta.stackexchange.com can and has been).

To fix (?) the issue we would need to purchase and maintain certificates for each *.stackexchange.com subdomain.

Now, given that http links already redirect properly and that all links that predate the schema move should have been http (since https would throw that scary warning page) and that we have also rewritten links to the meta sites to both have the correct schema and protocol, there really shouldn't be all that many links to the old schema that use https.

So, given the costs and the little benefit (if any) of fixing this - we will not be fixing it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .