25

As seen from this post, Stack Exchange network is transiting to the HTTPS protocol.

In the list of things to be done, one item caught my attention:

  1. (Child metas) Move from meta.*.stackexchange.com to *.meta.stackexchange.com.

So, from what I understand:

Just curious, why is this change needed?

2

1 Answer 1

40

As Nick Craver explains in his intro blog post from a few years back, meta.*.stackexchange.com is not a valid wildcard certificate. And the upkeep of managing 166 sites, plus 164 child meta sites, all listed exhaustively and spread across certificates in groups of 100 per certificate (the maximum number of domains anyone will issue in a single certificate, and each certificate needing a separate IP address), is not something SE wanted to deal with. (Especially given private beta launches every so often.)

So that doesn't really leave many options.

23
  • 18
    Yeah, pretty much this. One *.meta.stackexchange.com certificate, vs 166 certificates (and more added every week).
    – Oded
    Mar 7, 2017 at 10:59
  • 17
    Ultimately, it's because some jerk bought *.*.com decades ago. So they pretty much ruined it for everybody. Mar 7, 2017 at 15:22
  • 8
    Doesn't the existence of automated CAs like Let's Encrypt makes this less of an issue, since you could just have a new cert automatically issued every time a new site is created (with no manual action required)?
    – Ajedi32
    Mar 7, 2017 at 16:54
  • 1
    @Ajedi32 but are they automagically renewed? Mar 8, 2017 at 8:10
  • 3
    @Pureferret: LE does auto-renew by default, and has a correspondingly short expiration time (90 days). Mar 8, 2017 at 8:11
  • 1
    @NickCraver - why wouldn't *.*.stackoverflow.com work, assuming your example does?
    – Shadow
    Mar 9, 2017 at 5:05
  • 3
    @shadow: Because the specs and implementations were changed to prevent that sort of exploit happening again. Mar 9, 2017 at 5:09
  • 2
    Why not just use certificates signed by a custom root CA and tell everyone to add it to their trust store? (Ducks) Mar 9, 2017 at 5:12
  • 1
    @NathanOsman: Seems legit, I'll just go tell CAcert how widely successful they've secretly been all this time, shall I? Mar 9, 2017 at 5:44
  • 2
    @shadow: The RFC in which this change was formalized is linked in the blog post -- tools.ietf.org/html/rfc6125#section-6.4.3. Other than that, I expect looking through the IETF mailing lists during the discussion of that RFC would be as enlightening as anything. Mar 9, 2017 at 5:46
  • 3
    This bothers me because IMO the *.meta.stackexchange.com doesn't make logical/semantic sense considering how the sites actually relate to each other. Mar 9, 2017 at 12:02
  • 2
    So now you have a *.stackexchange.com and a *.meta.stackexchange.com and it saves you from adding any new certificate for new children?
    – Cœur
    Mar 9, 2017 at 12:23
  • 2
    @LightnessRacesinOrbit: It's a fairly minor glitch from my perspective, although I do see what you're saying. The difference between "the Space Exploration part of the meta-space" and "the meta site for Space Exploration" is there, but still pretty small. Mar 9, 2017 at 12:26
  • 1
    The "each certificate needing a separate IP" excuse died in April 2014 when extended support for Internet Explorer on Windows XP ended. By that time, IE/XP was the only major browser not to support Server Name Indication (SNI). Mar 10, 2017 at 3:44
  • 2
    @DamianYerrick: Apparently, they're still having trouble with Android, although I don't know the details. (E.g. disq.us/p/15x94qc) Mar 10, 2017 at 3:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .