As I was researching a security related topic I visited the Security part of Stack Exchange for the first time (via google) and was sent to the HTTPS version of the site. Seeing the mixed content warning, I went straight to Meta to look for some answers - only to be greeted by a warm-hearted certificate mismatch.

Certificate mismatch

Now on the off-chance that attackers are truly intercepting my connection and stealing my information (in which case they just got access to my account - please forgive me for any future vandalism), it seems to me that it is a misconfiguration on the server. Furthermore, this would probably affect any site-specific Meta for an SE subdomain. Sites where meta. is the only subdomain, such as Stack Overflow meta and Stack Exchange meta are of course not affected as they match the single wildcard.

  • 3
    Unfortunately this is a known issue. It has been discussed at length, it has to do with how wildcard certs work. Here's hoping that each additional report will eventually convince SE to find a solution (no matter how painful).
    – AviD Mod
    Feb 2, 2015 at 9:16
  • 1
    @AviD Ah, I just found this blog post by Nick Craver, but nothing on meta.security. I also can't seem to find anything more recent than 2013. Am I just looking in the wrong places?
    – knbk
    Feb 2, 2015 at 13:44
  • 1
    yeah that's the one. meta.security is pretty much the same as meta.gaming or any other site here... I don't know if there is anything more recent, though they did re-confirm this sometime last year...
    – AviD Mod
    Feb 2, 2015 at 14:10


You must log in to answer this question.

Browse other questions tagged .