20

My company has several wireless networks with different public IP addresses. If I'm connected to one of them, I occasionally get a certificate error when connecting to stackoverflow.com.

The certificate's common name does not match the web URL and the certificate does not list stackoverflow.com in its SAN DNS names. However, the certificate common name has a stackexchange.com suffix, and is signed by DigiCert, so I presume it actually belongs to Stack Exchange. Therefore, I can only conclude that the Stack Exchange engineers made a mistake in their implementation (or in issuance of the certificate). Here's the error I get, below. I notified the SE team via the contact form over a month ago, but received no response. And it continues to happen periodically.

Enter image description here

21
  • 17
    Y'know, with access ports having the ability to read certs, there's a high probability that your company's internal networks are stripping the cert out at a higher level. I've seen this happen before with hospital WiFi. Quintuple check with your internal network team that they are not doing this, because this could compromise more than just your usage of Stack Overflow.
    – Makoto
    Oct 23, 2017 at 22:13
  • 4
    @Makoto How so, the cert is signed by DigiCert, not an internal company certificate authority. Thanks anyway for the response.
    – Kyle
    Oct 24, 2017 at 3:49
  • 1
    You seem to miss my point. Just because the cert is signed doesn't mean that the cert is entirely capable of propagating through your network. It has literally been seven years since I've seen something like that before, but it is entirely possible for a higher level router or access point to strip out a certificate, just to resign it with their own. Most researchers would call this a "man in the middle", and depending on your corporate policy, it's not entirely out of the realm of possibility.
    – Makoto
    Oct 24, 2017 at 3:51
  • 2
    @Makoto Again, thanks for responding... Pretty sure it would say digital signature invalid or something to that effect. Common name invalid points to a mismatch between the URL and certificate common name.That can't be faked at the network level because it invalidates the digital signature.
    – Kyle
    Oct 24, 2017 at 3:54
  • 1
    I say this also, having anecdotally never experienced any problems with Stack Overflow's certificates, or any suspicious connection issues. If you're seeing this on a specific page, or specific pages, then you should link to that as well. There have been spurious issues with the occasional advert, but without any links or anything else to go off of, all I can go off of is what I've experienced, and I haven't experienced anything that you have.
    – Makoto
    Oct 24, 2017 at 3:54
  • @Makoto By the way, here is the relevant chrome doc: support.google.com/chrome/a/answer/7391219?hl=en. It supports what I said, StackOverflow itself is misconfigured. My company doesn't own the DigiCert certificate authority, so I don't see how they could possibly man in the middle attack.
    – Kyle
    Oct 24, 2017 at 3:56
  • Could your company also get certs signed by DigiCert?
    – Makoto
    Oct 24, 2017 at 3:57
  • 2
    @Makoto I assure you, DigiCert does not allow private companies to issue certificates with common names or subject alternative names that do not belong to them. That would allow my company to issue e.g. google.com. I would also expect that Chrome would display a different error if the connection was invalid.
    – Kyle
    Oct 24, 2017 at 3:58
  • 2
    This is weird, did you try to actually connect when you see this message? Maybe your company proxy cached an old version of the certificate and it sometimes serves it(far fetched but I don't have a good explanation)? Don't know why people are downvoting this, @Makoto first comment is not a possible explanation.
    – Oleg
    Oct 24, 2017 at 6:06
  • @Oleg: Until the OP tells us a specific instance or page of this happening on, my SWAG is as good as theirs or yours.
    – Makoto
    Oct 24, 2017 at 6:11
  • 5
    I don't have an explanation handy off-hand, but I agree that downvotes on this make little sense. Bug reports/support requests are what MSO is here for, especially when the solution isn't particularly obvious.
    – Adam Lear StaffMod
    Oct 24, 2017 at 6:30
  • 1
    Looks like similar symptoms (including stackexchange.com in the certificate) to this question from a three years ago which was put down as "https was not [yet] fully supported". Has this work been completed?
    – TripeHound
    Oct 24, 2017 at 14:51
  • 2
    @TripeHound: HTTPS is fully supported.
    – Makoto
    Oct 24, 2017 at 14:54
  • 1
    The cert chain looks valid, though we'd have to see all the details of it. If it is valid, then there are only a few possibilities that I can think of, most of which put the blame on stackexchange. The only way it could be your fault is if your nameserver returned the address for qa.sockets.stackexchange.com for a query of stackoverflow.com Oct 24, 2017 at 14:55
  • 1
    @TripeHound: The certificate doesn't look rogue. I connected to qa.sockets.stackexchange.com with openssl s_client and it returned a valid certificate (for that site). The error is that the browser asked to go to stackoverflow.com but got a certificate that doesn't have stackoverflow.com in it's list of domain names it's valid for. Oct 24, 2017 at 15:01

2 Answers 2

19

There are multiple possible reasons for your observation, including something funny happening at stackexchange.com. It could also be a name service issue on your end, e.g. some DNS configuration problem or bug. As an experiment, I modified my /etc/hosts file (actually my /private/etc/hosts file on my Mac OS X box) to add the following entry:

198.252.206.25 stackoverflow.com

That IP address actually points to the qa.sockets.stackexchange.com. I then tried to go to https://stackoverflow.com and received the exact same error page you showed in your question.

This simply shows that a bad DNS cache or entry somewhere can be the cause of your problem.

2
  • This looks like a plausible explanation. I've edited my answer slightly, the clues might still prove useful but perhaps it's not a MITM after all.
    – user247702
    Oct 24, 2017 at 16:20
  • 4
    James, thanks for the response. After your advice, we've investigated this issue and confirmed that its DNS related, and only affects particular sites. I apologize to any SE/SO engineers who may have been offended, but I am not accustomed to DNS issues being the root cause for something like this and I really don't see the harm in entering bug reports, especially when this seems like the appropriate outlet for such concerns, and web contact form had no results. Thanks all!
    – Kyle
    Oct 24, 2017 at 20:40
4

stackoverflow.com not being listed in the SAN field is the problem. The real certificate has this value for the field:

Not Critical
DNS Name: *.stackexchange.com
DNS Name: stackoverflow.com
DNS Name: *.stackoverflow.com
DNS Name: stackauth.com
DNS Name: sstatic.net
DNS Name: *.sstatic.net
DNS Name: serverfault.com
DNS Name: *.serverfault.com
DNS Name: superuser.com
DNS Name: *.superuser.com
DNS Name: stackapps.com
DNS Name: openid.stackauth.com
DNS Name: stackexchange.com
DNS Name: *.meta.stackexchange.com
DNS Name: meta.stackexchange.com
DNS Name: mathoverflow.net
DNS Name: *.mathoverflow.net
DNS Name: askubuntu.com
DNS Name: *.askubuntu.com
DNS Name: stacksnippets.net
DNS Name: *.blogoverflow.com
DNS Name: blogoverflow.com
DNS Name: *.meta.stackoverflow.com
DNS Name: *.stackoverflow.email
DNS Name: stackoverflow.email

Note that the hierarchy does not match your screenshot:

screenshot of the certificate info

Something is MITMing you. This might help you locate the source of the issue.

1
  • 2
    Yes, that's the real certificate for SO. He appears to be getting a real certificate for qa.sockets.stackexchange.com. That one has SANs for qa.sockets.stackexchange.com, chat.sockets.stackexchange.com, mobile.sockets.stackexchange.com, stacksnippets.net. Oct 24, 2017 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .