3 ms·
By chance, I happened to type (note the www.) https://www.security.googleblog.com/ This immediately popped up a red warning in Chrome: Your connectio
by satbyy 11y ago
By chance, I happened to type (note the www.)
https://www.security.googleblog.com/
This immediately popped up a red warning in Chrome:
Your connection is not private
Attackers might be trying to steal your information from
www.security.googleblog.com (for example, passwords,
messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID
It seems that the SSL certificate is issued to *.googleusercontent.com. Given that we're talking of Google, I expected that the URL will redirect to non-www https site, but apparently not.
- philip1209 11y agoThis seems to be an edge case between how wildcard certificates work versus how HSTS works. Wildcard certs only validate one subdomain of depth (so *.foo.com cert does not validate a.b.foo.com). HSTS "includeSubDomains" will require a valid SSL cert for all recursive subdomains. It's a problem, but I don't think it's a problem worth solving.