232

Update: The network move has started, you can follow here: Network-wide HTTPS: It's time


This is a heads up, and a request for help.

HTTPS for our entire network is long overdue, but we've been working hard on it behind the scenes. Expect a pretty big blog post when we turn it on everywhere that details the journey.

There are a few lingering questions on HTTPS we're not confident in until we do it live. One of these is the Google site move in webmasters. It still (to our disbelief) treats HTTP and HTTPS as different properties. I have no idea why. And the "change of address" tool doesn't support such a move either:

Note: The tool does not currently support the following kinds of site moves: subdomain name changes, protocol changes (from HTTP to HTTPS), or path-only changes.

So we'll have to create property sets for every single site during the move to HTTPS. Fun!

Given the above, we need to see how all of this works in practice with real load:
We're starting with meta.stackoverflow.com and meta.stackexchange.com.

Here's an order of things that's been going on:

  1. done Infrastructure in place:
    • A fast CDN/Proxy for local termination (Fastly)
    • Certificates (including IP pooling support to bridge HTTP/1.1 & HTTP/2)
    • Logging
  2. done Get third-party support in place:
    • All per-site scripts onto our CDN and served securely
    • Ad providers to HTTPS
  3. done Fix a ton of code that assumes http:// in a million places.
  4. done Prevent users from embedding new http:// content (e.g. forcing HTTPS images).
  5. done Cleanup all existing user content that was http:// (https:// where possible, and converted to links if we can't embed it securely).
  6. done Make sites render absolute URLs as https://.
  7. done Move canonical URLs to https://.
  8. done 302 Traffic to https:// for search engines.
  9. done 301 Traffic to https:// for search engines.
  10. done 301 Traffic to https:// for all.
  11. done (Child metas) Move from meta.*.stackexchange.com to *.meta.stackexchange.com.
  12. Force all Q&A traffic to https:// (and set an https-only cookie)
  13. Migrate all existing sessions to secure sessions (this will take time to run).
  14. Use HSTS to ensure browsers don't hit Q&A sites via http:// at all.

This is a really high level list, there are a crazy number of nuances and edge cases to the above. This is for Q&A. Area 51, Chat, and stackexchange.com (the main site) have a separate set of concerns and code we'll address after Q&A. The list also isn't necessarily in order. While we're testing #6, Samo and I will be working on #11 at the same time.

We want your help simply reporting any issues here with insecure content on https:// or any other oddities you see. We'll try to address them as soon as possible.

30
  • 69
    Yay! Congratulations! Naturally, 1st priority is to make sure the <kbd> castle question works ok and without edge cases. Everything else can wait. Checking now. (Edit: all is well.)
    – Pekka
    Commented Mar 6, 2017 at 15:10
  • 7
    Great job @Nick, the road to SSL was certainly a hard one!
    – Bhargav Rao Mod
    Commented Mar 6, 2017 at 15:19
  • 15
    Should this be featured perhaps?
    – Martijn Pieters Mod
    Commented Mar 6, 2017 at 15:29
  • 14
    Shouldn't this really be on MSE?
    – Cai
    Commented Mar 6, 2017 at 15:30
  • 6
    @MartijnPieters nope - it's not affecting SO yet. When we leave the test realm on this site it'll appear on MSE as featured.
    – Nick Craver Mod
    Commented Mar 6, 2017 at 15:34
  • 5
    @Cai nope - it only affects MSO right now. Once we shake out any issues here, then we'll begin MSE and network-wide moves.
    – Nick Craver Mod
    Commented Mar 6, 2017 at 15:35
  • 15
    Given that you mention changing the url of the child meta as part of the process I really think you should move this to MSE.
    – ChrisF Mod
    Commented Mar 6, 2017 at 15:47
  • 3
    @NickCraver Even if it only affects MSO right now, are you going to post on MSE once it affects everyone else?
    – Seth
    Commented Mar 6, 2017 at 15:53
  • 2
    @ChrisF Yes, we know this will eventually affect the whole network, and this will be announced on MSE once we are done testing here on MSO. For now, this only affects MSO where it is being tested.
    – animuson StaffMod
    Commented Mar 6, 2017 at 15:56
  • 9
    @animuson I understand that it's only being tested on MSO, but the post makes reference to MSE and other sites in the network so I thought that posting on MSE would be matter of courtesy if nothing else.
    – ChrisF Mod
    Commented Mar 6, 2017 at 15:58
  • 4
    @Seth yes, there will be a different MSE post when it's time.
    – Nick Craver Mod
    Commented Mar 6, 2017 at 16:07
  • 10
    *.meta.stackexchange.com I'm going to be struggling with this for quite some time, I fear...
    – user1228
    Commented Mar 6, 2017 at 17:16
  • 2
    @Will can you elaborate there? We'll have redirects in place of course.
    – Nick Craver Mod
    Commented Mar 6, 2017 at 18:10
  • 3
    More out of curiosity than anything else, what's the technical reason for the child meta name flipperoo? I assume it's something to do with your certificates?
    – jscs
    Commented Mar 6, 2017 at 18:42
  • 7
    @JoshCaswell: Wildcards only work on the leftmost subdomain, so meta.*.stackexchange.com is not possible, and provisioning 160-odd sites across 320-odd domains, with no more than 100 sites per certificate, did not seem to the team like a fun project. Commented Mar 6, 2017 at 22:34

2 Answers 2

24

For tracking purposes, so people can see at a quick glance:

Running list of fixed items (please keep reporting!):

  1. Network-wide flair
  2. Site switcher dropdown
  3. Share URLs were http:// (in build 2017.3.6.25308)

Known issues

  1. Footer links are relative (this has been the case for some time...we're deciding what to do there due to caching constraints)
  2. The Child-Meta move has resulted in a bug with HTTPS-Everywhere, resulting in ERR_TOO_MANY_REDIRECTS. Either temporarily disable HTTPS-Everywhere or wait for the fix to be merged and released upstream
11
  • 1
    I'm looking at this page's source, and there are a few http links: the <head> metadata twitter:app:url:googleplay and og:url links, canonical URL, and the sidebar "Featured on Meta" and "Hot Meta Posts". All of these sort of make sense, so maybe it's intentional.
    – Kobi
    Commented Mar 6, 2017 at 18:10
  • 1
    Found a minor one: the user settings > connected applications page (for me meta.stackoverflow.com/users/apps/7586 ) has an http winter bash logo (!?): i.sstatic.net/sRnbB.png
    – Kobi
    Commented Mar 6, 2017 at 18:42
  • 1
    The RSS feed has been acting hinkey lately, with double entries (at least within my feed reader). Not all of them, but I'm getting dupe links with one being http and the other https. Not sure if it's the fault of the reader or the feed.
    – user1228
    Commented Mar 6, 2017 at 18:49
  • 1
    @Kobi do you mean the icon in the top bar of your browser? Not for me.
    – Riker
    Commented Mar 6, 2017 at 21:32
  • 1
    @riker no they are talking about the <head> element in the HTML itself.
    – user4639281
    Commented Mar 6, 2017 at 23:29
  • 1
    Serious problem: Apparently images are being enforced to have HTTPS. This is a problem for flairs, as the main sites seem to support HTTPS but the meta's don't. Here, when both images are http only, and when https on both. As you can see, the main site flair works but the meta doesn't.
    – Riker
    Commented Mar 7, 2017 at 0:19
  • 1
    @Riker - yep, that's correct. We won't have working HTTPS flair on child metas until the domain move. We're working on that now, but it's not a new situation. HTTPS content has never worked on child metas...so we're fixing quite a wide range of things here.
    – Nick Craver Mod
    Commented Mar 7, 2017 at 3:05
  • 1
    Another weird RSS hiccough... All my RSS feeds came with the same batch of perl questions i.sstatic.net/XZJVU.png the original questions never had the tags, it appears. The image is for EnvDTE, here's one from the list stackoverflow.com/questions/42644082/… Checking the RSS feed now I don't see any of these questions in there, so it appears it might have been a temporary issue. Wanted to report it anyhow (not worth a question on its own)
    – user1228
    Commented Mar 7, 2017 at 16:08
  • 1
    The footer links being relative shouldn't matter, right? I mean, if the whole network gets switched to HTTPS then those links will also be always on an HTTPS page and thus link to the HTTPS version Commented Mar 16, 2017 at 14:28
  • 1
    I just noticed that the “Possible duplicate” auto-comments are still linking with http. Commented Apr 14, 2017 at 3:19
  • 1
    I noticed that the links in Hot Network Questions that redirect to the site don't include the "https://" (stackoverflow.com/... instead of https://stackoverflow.com/...). Commented May 16, 2017 at 15:46
-5

(Child metas) Move from meta.*.stackexchange.com to *.meta.stackexchange.com.

This is a terrible idea! Here's why.

Say there's the site waffles.stackexchange.com. Waffles SE. Now, just like any other site in the StackExchange network, Waffles SE has Meta Waffles SE.

Meta Waffles SE is part of Waffles SE. Therefore, its URL will be meta.waffles.stackexchange.com. meta.waffles.stackexchange.com implies that you're on the Meta subdomain of Waffles.

Now say we move it to waffles.meta.stackexchange.com. Whoa, what? Meta SE is its own thing - its own site! Waffles isn't part of Meta SE!

meta.waffles.stackexchange.com implies Meta of Waffles of StackExchange.

waffles.meta.stackexchange.com implies Waffles of meta of StackExchange.

Please, don't change it to something that makes no sense! Don't mess with a constant part of StackExchange! People who've been around the network for a while are not going to like this - no one will want to adjust to this change.

9
  • 4
    No downvote, but I do wish you'd used 'cheese' instead of 'waffles' for your example. :)
    – brichins
    Commented Mar 8, 2017 at 23:28
  • 18
    Child metas are being moved from meta.sitename.SE to sitename.meta.SE because browsers don't accept TLS certificates with the scope meta.*.stackexchange.com (or any other certificate for any domain name that has a wildcard in the middle). Also, people not wanting to change can be easily solved by redirecting all meta.sitename.SE traffic to sitename.meta.SE. Commented Mar 8, 2017 at 23:29
  • 3
    @dorukayhan: But why do we need TLS certificates with the scope meta.*.stackexchange.com?
    – ruakh
    Commented Mar 9, 2017 at 0:52
  • 2
    @ruakh Because meta.*.stackexchange.com is for some reason not a subset of *.stackexchange.com. Commented Mar 9, 2017 at 0:55
  • 1
    @dorukayhan: Ah, right. (I think that behavior is actually browser-dependent -- but of course we want a solution that does not depend on the browser.) Thanks!
    – ruakh
    Commented Mar 9, 2017 at 0:58
  • 1
    Actually, there's a RFC for it tools.ietf.org/html/rfc2818: Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.
    – Braiam
    Commented Mar 9, 2017 at 2:06
  • 7
    Nick Craver's personal blogpost on this very issue - which is linked in the main question anyway - is the best primer to this subject. It explains clearly why the switch is needed, in spite of your objections to the name changes.
    – Makoto
    Commented Mar 9, 2017 at 2:28
  • 5
    The comments are correct here - see my blog post for details. The jerk who bought *.*.com and ruined it for everybody means we have no other real options here without tremendous complication on many fronts - and greatly increased cost. It also eliminated IP pooling possibilities, which let us keep HTTP/1.1 and HTTP/2 optimized across domains at the same time. Redirects were always the plan, and are automatically in place due to how we do the move. Example: meta.security.stackexchange.com
    – Nick Craver Mod
    Commented Mar 14, 2017 at 15:11
  • While semantically he's correct, it does seem as though internet limitations may prevent continuation of the old method from being feasible.
    – Leo Wilson
    Commented Mar 19, 2017 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .