160 votes
Accepted

Should we display a warning when users include images?

Perhaps a more in your face "Don't do this" would work with the image upload dialog: Ps this is only a semi-serious suggestion, as I doubt even something this drastic would make any difference if it ...
Tanner's user avatar
  • 22.5k
54 votes
Accepted

Is Stack Overflow secure even when not using HTTPS?

No, there are a number of things about the http connection that are not secure. Your traffic can be sniffed. This means that someone can see what pages you're visiting. This may or may not be a ...
Laurel's user avatar
  • 6,103
46 votes
Accepted

Mixed content ad

We have paused this campaign until the advertiser removes or fixes this pixel. Update: The advertiser has disabled this content and the campaign is live again.
Denimjean's user avatar
  • 107
39 votes
Accepted

Why are child meta links flipped after transition to HTTPS?

As Nick Craver explains in his intro blog post from a few years back, meta.*.stackexchange.com is not a valid wildcard certificate. And the upkeep of managing 166 sites, plus 164 child meta sites, all ...
Nathan Tuggy's user avatar
  • 2,236
38 votes

HTTPS-only images

status-completedfeature-request Update the Flair HTML snippet Can you please update the HTML snippet in the Flair section with https in the <img src="http://. Since copy & paste the snippet ...
Arulkumar's user avatar
  • 13.1k
38 votes
Accepted

Ad causing mixed content in HTTPS

Reaching out to the client now to get this fixed. The ads have been turned off in the meantime, so you shouldn't see these warnings anymore. As always, appreciate the heads up! UPDATE The ads have ...
Denimjean's user avatar
  • 107
34 votes
Accepted

Wikipedia links not https, is there a special reason they shouldn't?

No, the HTTPS change only applied to Stack Exchange links. SE has no idea which sites do and don't support HTTP. It'd be a bad idea to replace every single link in every single answer like that. If ...
Cerbrus's user avatar
  • 71.8k
28 votes

Mixed content ad

A twitter discussion led to upgrade-insecure-requests being deployed on all Q&A sites. All requests will automatically get updated to https: if the browser supports this directive, which all ...
vcsjones's user avatar
  • 140k
25 votes

Should we display a warning when users include images?

As gnat noted, we already had a warning for this - we just broke it a year ago and never noticed. Adam Lear fixed this 10 days ago, and I'm happy to report that it's once again in the face of any ...
Shog9's user avatar
  • 158k
24 votes

HTTPS: It's time

For tracking purposes, so people can see at a quick glance: Running list of fixed items (please keep reporting!): Network-wide flair Site switcher dropdown Share URLs were http:// (in build 2017.3.6....
Nick Craver's user avatar
23 votes

How to make a working snippet with a library not available in HTTPS?

The best solution is to find an HTTPS based source for the file you desire to use. Files in GitHub repositories are always available via HTTPS jsDelivr (instructions for GitHub links) Example: ...
Makyen's user avatar
  • 32.7k
21 votes

adzerk.net causes mixed content error on main site

We're on it! We see those issues as well, and we're working with our ad server to get this addressed. It will take time, and it will only apply to new tag sponsorships in the future. Updating every ...
stevvve's user avatar
  • 107
19 votes
Accepted

Certificate error when using stackoverflow.com from certain IP addresses

There are multiple possible reasons for your observation, including something funny happening at stackexchange.com. It could also be a name service issue on your end, e.g. some DNS configuration ...
President James K. Polk's user avatar
19 votes
Accepted

A required TLS feature is missing. Error code: MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING

We have worked with our CDN provider to roll back a change that was made enforcing OCSP Must-Staple. Firefox should be back in business, sorry for the interruption. To keep up to date follow our ...
Geoff Dalgas's user avatar
  • 6,156
17 votes
Accepted

Why does Stack Overflow's help page say the SSL certificate is issued for footballsupport.geniussports.com?

That's just the first domain listed on the certificate. Ours is in the alternative names section, along with a list of other domains using Freshdesk. I believe it's some sort of global "custom domains ...
animuson's user avatar
  • 54.4k
16 votes
Accepted

The certificate for itr-links.stackoverflow.email has expired

That certificate was being managed by a 3rd party and has now been renewed. When we implemented CAA records we didn't include Amazon which prevented the certificate from automatically renewing.
Josh Zhang's user avatar
  • 127
14 votes

Is Stack Overflow secure even when not using HTTPS?

The best that we know about is that it's still in progress. Here's a similar question on Meta Stack Exchange which has some details. To answer your specific questions... Your login is secured ...
Makoto's user avatar
  • 105k
11 votes

Should we display a warning when users include images?

I don't think the users1 would read this warning message because they don't read any of the help pages or the help text on the right side. 1The users who are posting in wrong format etc. If a user ...
Hille's user avatar
  • 2,202
9 votes

Bad SSL link on Stack Overflow blog pointing to Stack Overflow Enterprise site

This was an improper link created that should have pointed to the www. website. I pushed an update to fix them, it'll be live in 1 minute and 24 seconds. Now 22. Now 21. Okay hitting submit.
Nick Craver's user avatar
9 votes

Is Stack Overflow secure even when not using HTTPS?

Laurel and Makoto's answers more or less say what I was going to say. We aren't doing anything special to the inherently not-secure HTTP traffic. However, certain parts of the site are already ...
Adam Lear's user avatar
  • 38.4k
8 votes
Accepted

Stack Overflow SSL certificate appears invalid to my browser

One reason for this type of problem is that your browser is still using any of the expired certificates, like 'DST Root CA X3' certificate. So you can do one thing. Just check your certificate (by ...
Ravi's user avatar
  • 1
7 votes

SE Network Login Test Page: "Messaging failed; stackauth.com skipped" - Am I missing something?

This entire test page is... Woefully obsolete. Even if all the tests completed successfully, there's no guarantee you'll be able to log in... And of course, the tests failing indicates nothing, since ...
Shog9's user avatar
  • 158k
6 votes
Accepted

Has the community bot changed too much in changing HTTP links to HTTPS?

As mentioned, this only works with questions that aren't deleted because deleted questions simply don't exist as far as the public API is concerned. There's a reason they're called deleted questions ...
BoltClock's user avatar
  • 712k
5 votes

https://www.stackoverflow.com redirects to insecure http://stackoverflow.com

Can we remove all absolute urls like this one... <a href="http://stackoverflow.com/questions/..." ...> And make them protocol relative: <a href="//stackoverflow.com/questions/..." ...> ...
dnozay's user avatar
  • 24.1k
5 votes

Link to chat from Site Switcher is not HTTPS

This look to be fixed since at least this morning. The links in the Site Switcher are now <div class="related-links"> <a href="https://stackoverflow.com/help" class="js-gps-track" data-...
NathanOliver's user avatar
5 votes
Accepted

SE Network Login Test Page: "Messaging failed; stackauth.com skipped" - Am I missing something?

This is not a problem on your side, but one in the test-page's code itself. The code still expects non-secure http:// scheme in multiple places, and thus fails because of the recent https:// upgrade ...
Kaiido's user avatar
  • 130k
4 votes

Certificate error when using stackoverflow.com from certain IP addresses

stackoverflow.com not being listed in the SAN field is the problem. The real certificate has this value for the field: Not Critical DNS Name: *.stackexchange.com DNS Name: stackoverflow.com DNS Name: ...
user247702's user avatar
4 votes
Accepted

Talent - Company page shows "Connection is Not Secure" error due to the http:// image

We're been running with HSTS enabled on talent.stackoverflow.com for a little over a year now and have been monitoring Content-Security-Policy reports to make sure this is a rare to non-existent ...
Dean Ward's user avatar
  • 4,793
4 votes

HTTPS-only images

Prevent submission of posts that contain HTTP images. […] [In] remaining posts with HTTP images [that are not HTTPS-accessible] no Markdown will be affected. Wait, does that mean when I'm trying to ...
Bergi's user avatar
  • 650k

Only top scored, non community-wiki answers of a minimum length are eligible