5

Visiting https://meta.security.stackexchange.com displays an HTTPS certificate error in Google Chrome and Internet Explorer 10.

For reference, meta.<sitename>.stackexchange.com is the old URL for per-site metas. Child metas were migrated to <sitename>.meta.stackexchange.com during the implementation of network-wide HTTPS support. The old URLs were configured to silently redirect users to the correct page.

This issue has technically been reported a few times before, (1, 2, 3, 4, 5). However, these reports were made before HTTPS support for child metas was officially completed in March 2017.

Security error for meta.security.stackexchange.com

  • Not really a bug, not on SE side at least, unless you find a link inside SE which points to such URL. Those links should be fixed from their source. – ShaWiz Jul 31 '17 at 14:49
  • The old meta url will still produce error. Use the new url – Optimus Prime Jul 31 '17 at 14:49
  • 1
    @animuson is it status declined or status bydesign? – Optimus Prime Jul 31 '17 at 14:50
  • 2
    @SagarV - both. Both is good. – Oded Jul 31 '17 at 14:51
6

The old Meta URLs will never support HTTPS. The whole point of changing the path to *.meta.stackexchange.com was because because wildcards cannot use meta.*.stackexchange.com and we couldn't apply a single certificate to all of the Meta domains. We are not interested in maintaining a bunch of certificates for all the domains just to support an outdated URL scheme that was replaced for the very reason we couldn't support it.

Since we now automatically redirect users to the secure version of the site, using an old URL will already get them to thew new, secure version of the page via a redirect.

6

Actually, going to http://meta.security.stackexchange.com redirects. However, https://meta.security.stackexchange.com does not have a certificate, which is why you are seeing that screen.

The whole point of moving the scheme to meta.<sitename>.stackexchange.com was to reduce the maintenance costs of certificates (given that a *.*.stackexchange.com certificate is not obtainable, nor can a meta.*.stackexchange.com one, but a *.meta.stackexchange.com can and has been).

To fix (?) the issue we would need to purchase and maintain certificates for each *.stackexchange.com subdomain.

Now, given that http links already redirect properly and that all links that predate the schema move should have been http (since https would throw that scary warning page) and that we have also rewritten links to the meta sites to both have the correct schema and protocol, there really shouldn't be all that many links to the old schema that use https.

So, given the costs and the little benefit (if any) of fixing this - we will not be fixing it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .