32

This is a semi-duplicate of https://www.stackoverflow.com redirects to insecure http://stackoverflow.com, but it has been deferred for ~2 years.

It seems that HTTPS is now supposed to work on Stack Overflow, and it is past the 6-8 weeks of test time for HTTPS.

Do we know when the full rollover to HTTPS on Stack Overflow will be?

14
  • 26
    Unfortunately, I think it's still deferred. Too much time spent focusing on adding new features of dubious merit. No one likes to pay technical debt. Aug 29, 2016 at 17:17
  • 7
    It's not possible to give an exact timeframe, but a lot of progress has been made on this in the past few months.
    – animuson StaffMod
    Aug 29, 2016 at 17:22
  • It doesn't work? It was my understanding that ssl doesn't work on per-site metas (I'm using https/ssl on meta.SO right now, without any issue).
    – Zizouz212
    Aug 29, 2016 at 19:47
  • @Zizouz212 Try to go to https://www.stackoverflow.com you will be redirected
    – Naftali
    Aug 29, 2016 at 19:48
  • 1
    Hmmm... That doesn't work for me, I just use https://stackoverflow.com and it doesn't complain.
    – Zizouz212
    Aug 29, 2016 at 19:49
  • 1
    @Zizouz212 I know :-)
    – Naftali
    Aug 29, 2016 at 19:49
  • 8
    Full HTTPS support is expected in 6 - 8 weeks.
    – Glorfindel
    Aug 29, 2016 at 20:30
  • "Around 6 to 8 weeks" Aug 30, 2016 at 16:09
  • 1
    I'm pretty sure we will get another April fools game in 2017 before this gets implemented. There are other important stuff to be taken care of, you know?
    – T J
    Aug 30, 2016 at 16:34
  • You cannot be serious @BradWerth ... Read my question...
    – Naftali
    Aug 30, 2016 at 16:41
  • I did. It is the same feature, status deferred. When that tag gets removed, it will be in place... I get that it seems like an insane amount of time to implement a very simple thing, but this really boils down to the same exact question. Being it has been literally years, I would put money on Unikong 4 before TLS.
    – Brad Werth
    Aug 30, 2016 at 16:44
  • @BradWerth that Q is a bug report for one...
    – Naftali
    Aug 30, 2016 at 16:45
  • I think Adam Lear's answer backs me up... Same thing, status deferred, as you yourself have pointed out.
    – Brad Werth
    Aug 30, 2016 at 16:46
  • @TJ You have a point. If we put every developer in the company on the same project, it'll get done that much faster.
    – Adam Lear StaffMod
    Sep 6, 2016 at 17:20

1 Answer 1

16

Do we know when the full rollover to https on Stack Overflow will be?

No, we don't.

I can tell you that it's being worked on (next step: moving meta sites to the *.meta.stackexchange.com URL scheme from meta.*.stackexchange.com), but there is no deadline or ETA. We're solving issues, paying down tech debt as needed, and making progress as time allows amidst everything else that's currently in progress.

11
  • 3
    Hmmm why the meta url swap? (curiosity)
    – Naftali
    Aug 29, 2016 at 19:08
  • 16
    @Neal In short, because we can't get a wildcard cert to cover meta.*.stackexchange.com, and getting 150+ (and counting) individual certs isn't feasible either. More details in Nick's blog post: nickcraver.com/blog/2013/04/23/…
    – Adam Lear StaffMod
    Aug 29, 2016 at 19:10
  • 4
    @AdamLear Naive question: is a free automated cert service like letsencrypt.org a viable solution to the "getting 150+ certs isn't feasible" problem?
    – ThisClark
    Aug 30, 2016 at 0:08
  • @ThisClark Not in our case - the issue isn't just the provisioning and the cost. Nick goes into the issues with that approach in his post towards the end: search for "We would prefer not to change domains for our content" to jump to the right spot.
    – Adam Lear StaffMod
    Aug 30, 2016 at 0:13
  • 5
    @AdamLear "what happens to our google rank when we start sending everyone to HTTPS, including crawlers? " - it will probably go way up when Google stops penalizing you for not using HTTPS. (Yes I know you didn't write that; it's in response to your link)
    – user253751
    Aug 30, 2016 at 0:48
  • @immibis Eh, that post is now over 3 years old. ;) We aren't hurting for ranking still AFAIK, but yeah, that part of the post probably doesn't apply (as much or at all) anymore.
    – Adam Lear StaffMod
    Aug 30, 2016 at 0:56
  • 2
    I don't see why you need a dedicated IP for every cert, SNI is well supported nowadays (so wildcard certificates or lots of subject alternative names are not really needed) - also Let's Encrypt can easily be used to get lots of certificates w/o problems (or costs)...
    – MrTux
    Aug 30, 2016 at 16:59
  • @MrTux which is why Let's Encrypt isn't widely considered trustworthy. Sep 1, 2016 at 8:28
  • 1
    @Qix Let's Encrypt is widely considered trustworthy: community.letsencrypt.org/t/…
    – MrTux
    Sep 1, 2016 at 9:29
  • @MrTux Handing out certificates willy-nilly goes against the whole concept of trust-based cryptography unless they regularly evaluate the people they sign. Sep 1, 2016 at 20:35
  • @Qix From my experience most certificates are just domain validated as Let's Encrypt does. - if you are talking about EV certificates, there also hard limits apply (IIRC no wildcards: serverfault.com/a/69977).
    – MrTux
    Sep 2, 2016 at 11:29

Not the answer you're looking for? Browse other questions tagged .