13 ms·

Bing doesn't support SSL

287 points by timthelion 14y ago

casca 14y ago
TL;DR: bing SSL certificate is wrong. https://bing.com https://bing.com: subject=/CN=*.bing.com https://www.bing.com https://www.bing.com: subject=/C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net
- ThisIsADogHello 14y ago
  Don't forget the X09v3 alternate subject names. https://bing.com/ https://bing.com/ Subject: CN=* .bing.com X509v3 Subject Alternative Name: DNS:ieonline.microsoft.com, DNS:* .bing.com, DNS:* .windowssearch.com -- https://www.bing.com/ https://www.bing.com/ Subject: C=US, O=Akamai Technologies, Inc., CN=a248.e.akamai.net X509v3 Subject Alternative Name: DNS:a248.e.akamai.net, DNS:* .akamaihd.net, DNS:* .akamaihd-staging.net
- mrspeaker 14y ago
  Wow, that's the first time I've ever seen a 0-word article get the TL;DR treatment.
  - return0 14y ago
    Actually the warning message from chrome is pretty lengthy
    - vitorarins 14y ago
      At first I thought it was a joke from Google. Something like: "No you don't want to use bing, here is google."
      - gcb0 14y ago
        ...what kind of massage you received? My browser only talk about the warning, but i only have old chromium... Not auto-updating g chrome
        piyush_soni 14y ago
        All people giving downvotes to this comment, I think you are being unfair to this person who just seems to have a bad English. He probably meant "message".
        antonpug 14y ago
        lol
        marshray 14y ago
        The medium is the massage. https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage
        gcb0 14y ago
        was typed on swype :) didn't notice the typo
        derpenxyne 14y ago
        This is the latest message: http://i.imgur.com/ogDhMQp.png http://i.imgur.com/ogDhMQp.png
        3825 14y ago
        back to safety takes me to about:blank Does it take you to https://www.google.com/ https://www.google.com/ ?
  - hasenj 14y ago
    TL;DR means "here's a very short explanation".
    - JonnieCache 14y ago
      Who else remembers when it used to be an insult? I preferred it that way.
      - highwind 14y ago
        Yeah. I remember TL;DR meant wall of text, kinda same way RTFM was used. It was a response to something not a tag to indicate what you were doing. How things change so fast on the Internet.
        azernik 14y ago
        The new meaning is a lot more useful (in the sense that I find lots of opportunities to use it).
        homosaur 14y ago
        Agreed, I still have insults a plenty in my quiver.
        dragontamer 14y ago
        TL;DR: You prefer the old way of doing things.
    - coin 14y ago
      Why not use the word "summary"?
      - hasenj 14y ago
        I think it's the same reason people write "lol" instead of "hahaha" even though they are not actually laughing out loud. It sounds like internet speek, it's cooler and more 1337.
- elliottcarlson 14y ago
  We were experiencing a similar issue with a third party analytics solution where their SSL cert all of the sudden started to be delivered by Akamai as opposed to the FQDN of the company, as it was before. I am curious if Akamai is at fault here?
  - johngunderman 14y ago
    Was this in the past week? Because just a few days ago I was experiencing a similar problem. I attempted to access https://rememberthemilk.com https://rememberthemilk.com and chrome complained about the SSL cert, as I was receiving the cert for their CDN and not for rememberthemilk itself. I couldn't find anyone that could reproduce the issue, but it occurred consistently on my computer regardless of browser. It resolved itself 20 min after I first noticed it, but I'm still really curious as to why it happened in the first place.
    - elliottcarlson 14y ago
      Yeah - happened on Tuesday and was cleared up the following morning.
    - andygambles 14y ago
      Usually the CDN will have a single certificate which then has multiple SAN entries. What can happen depending on the size of the CDN is it can take a long time for the SSL to be added to the SAN entries on all the edge servers. So if a site just starts moving to a CDN they sometimes jump the gun and instead of waiting for all the edge servers to have the SSL they just change DNS records. You then have a scenario where the DNS is waiting to propagate and the SSL is still propagating around the CDN. Hence you get soem users without a problem, some with and it eventually all clears itself up.
  - brokentone 14y ago
    This is Akamai kinda trying to serve HTTPS on domains that don't have HTTPS setup. I'm not sure why they attempt it at all, but it's not really their fault. Same thing on my domain: https://www.theblaze.com/ https://www.theblaze.com/
- freehunter 14y ago
  Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge security risk, and defeats the purpose of even having an SSL cert. Companies! Make sure your certs are all in order! There's no reason to send a page to your users over HTTPS if they can't trust the certificate. Canonical has been a long-time offender of this, with many of their pages sporting a certificate signed to canonical.com but being served by ubuntu.com.
  - T-hawk 14y ago
    > There's no reason to send a page to your users over HTTPS if they can't trust the certificate. There can be. HTTPS still gives you encryption over the wire. It still protects against a passive eavesdropper, like a casual packet sniffer on a public wi-fi network. The whole certificate deal protects against a Mallory with power to intercept and spoof messages. Of course nobody on the public internet can be sure there isn't a Mallory in or at the edge of the user's ISP, but in plenty of intranet or otherwise controlled networking scenarios, HTTPS with certificates lacking a trust chain can be reasonable.
    - ajross 14y ago
      Right. MitM attacks and variants are a proper subset of the mischief that can be achieved with an unsecured connection. Among other things, it's routine that people (hi!) use self-signed certs for personal or temporary TLS sites. I'd be very annoyed to pass a basic-auth-protected https git url to someone for quick-and-mostly-secure read-only access and have their access be denied by a local proxy...
      - freehunter 14y ago
        >I'd be very annoyed to... have their access be denied by a local proxy Untrusted certificate chains is a valid security risk. If it annoys you that users are blocked from viewing your site because you haven't gone through the established and accepted practice of actually completing the SSL trust chain, that's not the local proxy's fault. My number one concern is the integrity and security of my company's data. Your personal or temporary TLS site is much lower down that list, especially if you're serving up untrusted certificates and expecting that users will completely ignore the warnings that try to keep them from falling victim to the kinds of attacks SSL is meant to avoid.
- rhplus 14y ago
  TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Bing does support SSL on ssl.bing.com and publishes various links on that sub-domain, such as https://ssl.bing.com/webmaster/home/mysites https://ssl.bing.com/webmaster/home/mysites The fact that the https://www.bing.com https://www.bing.com redirects to the HTTP version should be enough to show that this a known, unsupported case on the primary domain. The behavior has been like that for years.
  - TazeTSchnitzel 14y ago
    >TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Or use HTTPS Everywhere. Personally, I'd also like it if in future, web browsers would try HTTPS first and HTTP second.
    - deleted 14y ago
      [deleted]
      - decklin 14y ago
        http://en.wikipedia.org/wiki/Server_Name_Indication#Support http://en.wikipedia.org/wiki/Server_Name_Indication#Support
    - wiml 14y ago
      I don't think browsers should assume that http://blahblah http://blahblah and https://blahblah https://blahblah refer to the same resource.
      - ricardobeat 14y ago
        Why not?
Ricapar 14y ago
Looks like someone pushed the wrong SSL cert to production: www.bing.com uses an invalid security certificate. The certificate is only valid for the following names: a248.e.akamai.net , *.akamaihd.net , *.akamaihd-staging.net (Error code: ssl_error_bad_cert_domain)
- timthelion 14y ago
  http://revealingerrors.com/akamai_ssl http://revealingerrors.com/akamai_ssl
  - bshastry 14y ago
    The post does not explain why Akamai's cert is being used. If bing over SSL were working correctly in the past---which I believe to be true---and given that Bing were using Akamai in the past, why the problem now?
    - xonea 14y ago
      nope, bing did not work correctly in the past. A few web searches reveal that it has been like that since at least 2011.
    - SG- 14y ago
      Bing doesn't do SSL and never has at that domain (they previously used ssl.bing.com). you're seeing an Akamai cert because Akamai servers are hosting bing.com.
- dominicgs 14y ago
  Australian Ebay (https://www.ebay.com.au/ https://www.ebay.com.au/) has had the same problem for months, although I appear to get no response for https://www.ebay.com https://www.ebay.com, so I'm not sure what their policy is on SSL access to the homepage. I expect that Microsoft will fix Bing much more quickly.
  - ry0ohki 14y ago
nopal 14y ago
I made a site that checked for SSL cert expirations and misconfigurations, but I couldn't acquire any customers. I still think there's a business there somewhere, although maybe it really only sells as part of another product. Edit: If anyone wants a script to check their certificates, here you go: https://gist.github.com/bretwalker/5420652 https://gist.github.com/bretwalker/5420652. You'll just need to add in some sort of notification logic, especially for expirations, since they need to happen before a problem arises.
- simonw 14y ago
  Sounds like something you could license to companies to use as a lead generation tool - like HubSpot's Marketing Grader http://marketing.grader.com/ http://marketing.grader.com/
  - nopal 14y ago
    That's a very interesting idea, Simon, and one that didn't even cross my mind. I've since moved on to a new project. If anyone wants to talk about taking over the site, shoot me a message at bretwalker /at/ Google's email. It's Django and has some branding and a domain: http://static.nyquistrate.com.s3.amazonaws.com/media/certcian_logo.gif.png http://static.nyquistrate.com.s3.amazonaws.com/media/certcia...
- mdmarra 14y ago
  The sad thing is that SCOM can monitor for pending certificate expiration and validity. If Microsoft dogfooded a little more, they might have seen this.
- aduitsis 14y ago
  Which protocols do you support besides https? imap or pop with tls perhaps?
  - nopal 14y ago
    Yes, IMAP and POP were supported: https://gist.github.com/bretwalker/5420652 https://gist.github.com/bretwalker/5420652
aaronsnoswell 14y ago
The real question is, why were you on bing? :P
- heymishy 14y ago
  comment of the day!
  - ganarajpr 14y ago
    To Microsoft : Please fix your IE debacle ( somehow!!).. Its affecting your other products.. Its reputation is becoming infectious.
    - webreac 14y ago
      Do you mean Windows 8 debacle ? AFAIK, IE10 is a good browser and IE9 is not so bad.
    - mdmarra 14y ago
      What IE debacle? Trident is now widely considered to have the most correct HTML5 implementation in a major browser. It might not have all of the draft stuff that Webkit has, but it also doesn't require all of the webkit css hacks.
      - theoutlander 14y ago
        Well, it can certainly do a lot better ... check out caniuse.com for more details.
        mdmarra 14y ago
        I think you missed missed point. Many of the features listed there are draft spec. Rapid adoption of early draft specs are what caused the current Webkit mess. IE 10 doesn't have the most features available, I never said it did. What I did say that that the features that are present are more correctly implemented than other browsers.
atc 14y ago
ssllabs.com
taylorbuley 14y ago
This is the second major flub this year. Azure's cert expired in prod not many weeks ago.
- timthelion 14y ago
  Actually, it's been like this a really long time. I just noticed, that HN stories which have nondescript titles fare better, so I decided to conduct a little experiment. 1st spot on the front page seems to confirm my hypothesis.
  - huhtenberg 14y ago
    Was it you who changed the submission title or was it some mod acting up yet again? The original was interesting and it wasn't factually inaccurate.
    - timthelion 14y ago
      Some mod... I was quite surprised when I saw it.
- xonea 14y ago
  Well, it is not really a flub of this year. Or even something specific to Bing (try https://www.nba.com/ https://www.nba.com/ or https://www.jetstar.com/ https://www.jetstar.com/) Basically Akamai is using the same ssl certifate on (most?) of its edge servers. The reason for that is that traditionally it is difficult to decide for a server that is serving multiple domains, which SSL certificate to show for a client -- the HTTP header, which contains the hostname is sent way after the certificate information has been exchanged. A certificate can contain several hostnames (in the SubjectAlternativeName extension) - but that does not scale if you have a big number of sites for a number of reasons (re-signing the certificate all the time is a nuisance, browser behavior with certificates containing several thousand hostnames is kind of fun, etc.). Nowadays there are solutions to that problem (using the Server Name Indication TLS extension -- which basically sends the desired hostname in the TLS exchange before the certificate is exchanged). However, the number of sites actively using SNI is very low - google is the only site known to me that is doing it (try accessing google.com with/without SNI and you will get completely different certificates). The reason why SNI is not yet that much used is that client support is still a bit flaky. Afaik it is supported by all recent desktop browsers. However, I think the XP TLS stack does not support it (and there are still enough users on that), android only supports it starting with version 3.0, etc. So - at the moment you basically still need a separate IP for each site (or at least one IP for sites that can share one certificate). I don't know if akamai also supports custom SSL certificates. Facebook seems to use kind of an interesting mix between akamai and self-hosting - facebook.com itself seems to be hosted by facebook. However, if you use facebook over ssl and check the url of served profile pictures, you will see that they go to https://fbcdn-profile-a.akamaihd.net https://fbcdn-profile-a.akamaihd.net (or similar) -- hence to one of the hostnames that is mentioned in the akamai edge certificates.
Y0L0 14y ago
I sincerely hope that this not some sick and twisted joke by Microsoft.
- theycallmemorty 14y ago
  I think you're in the clear.
deepblueocean 14y ago
Wow. This has been going on for an hour now. It's such a simple fix, especially since one would assume that they already have a valid cert somewhere (or that Akamai does). Yet they've had an hour of SSL downtime. Does anyone know if Bing has any SSL-only clients? Like do any of their toolbars or built-in search widgets in Windows use SSL by default?
- xonea 14y ago
  This is not new and probably will not be fixed fast - the situation has been like that (unchanged) since at least 2011.
- Trufa 14y ago
  Easy fix? What the hell? I don't like or use Bing services but when you get as big and complex as Bing, nothing is easy, it's not like you can open your text editor, modify one line, commit and push. There so many other variables to take into consideration, by hurrying to fix, you could face all sort of vulnerabilities / other issues. I'm not saying this error is acceptable, I'm saying it's ridiculous to say it's and easy fix without actually knowing anything, it might or it might now.
- timthelion 14y ago
  See https://news.ycombinator.com/item?id=5576342 https://news.ycombinator.com/item?id=5576342
- bcoates 14y ago
  I think it's always been like this. Bing has never run over https as far as I can tell.
- ricardobeat 14y ago
  According to MS guys this is not an error, SSL is supported at https://ssl.bing.com/ https://ssl.bing.com/ which is what their tools use.
smackfu 14y ago
Bing is normally not served over https, so this probably only affects a tiny percentage of the users, even though it looks bad here.
tosseraccount 14y ago
Short Microsoft. 25000 more employees can't fix this kind of incompetence.
- ccarter84 14y ago
  There's gotta be some kind of organizational size:responsiveness inverse metric for stuff like this
bwooceli 14y ago
back up as of 8:42 CST
- joshstrange 14y ago
  I'm still seeing it 9:50 EST
a_1 14y ago
why would you use bing?
LTheobald 14y ago
It's not just Bing. I'm always accidentally going to http://stackoverflow.com http://stackoverflow.com & getting an error.
- benparsons 14y ago
  I don't understand - that's never resulted in an error for me.
  - jsight 14y ago
    Maybe he meant https://stackoverflow.com/ https://stackoverflow.com/ ?
    - mikeash 14y ago
      Wow, that's just terrible.
- rschmitty 14y ago
  Shh, only MS bashing can go on in this thread
  - jonknee 14y ago
    SO uses a MS stack so it's not too far off...
pasbesoin 14y ago
Why should we take Microsoft's Internet efforts seriously when they continue, perpetually, not to do so, themselves? (Actions speak louder than words.)
mekoka 14y ago
The real question is, is bing.com even supposed to be served over https?
- city41 14y ago
  why wouldn't you want to serve it over SSL?
- sdfjkl 14y ago
  With very few exceptions, everything is supposed to be served over HTTPS (or other secure protocols). Certainly something as sensitive as search traffic. Tell me your search queries and I'll tell you your interests, health problems, relationships, if you're happy in your job and what kind of porn you like.
  - ccarter84 14y ago
    That last one is where they get ya
icecreamguy 14y ago
I've gotten a certificate error for over a year with Bing on HTTPS. I always just assumed that they, somewhat surprisingly, just didn't support HTTPS yet.
webignition 14y ago
Slightly off-topic: what's a good way to handle cases such as this where you have a wildcard certificate? I'll be getting a wildcard certificate for a project and, never having used one before, I had assumed the certificate would be valid for an entire domain. I understand from this situation that a wildcard certificate is relevant only to https://*.example.com https://*.example.com and not the subdomainless https://example.com https://example.com. Assuming that to be the case, is having a wildcard certificate for *.example.com and a second certificate for example.com the solution? It'd be nice to have the entire domain covered by a wildcard certificate and not just all subdomains.
- phlo 14y ago
  Not all that off-topic. For your example, you should get a certificate made out to ("Subject CN") example.com or * .example.com, then list both the wildcard and the subdomainless entry as Subject Alternative Names. Bing is doing something similar (see https://news.ycombinator.com/item?id=5576271 https://news.ycombinator.com/item?id=5576271), but they appear to have forgotten to list the plain domain.
- klapinat0r 14y ago
  Typically a certificate issuer will grant you both when you buy a wildcard one. This can be achieved via SAN (alternative names): http://en.wikipedia.org/wiki/Wildcard_certificate#Limitation http://en.wikipedia.org/wiki/Wildcard_certificate#Limitation
  - vsync 14y ago
    Comodo's been good to me in this regard. Incidentally, beware of RapidSSL and their "free www." SAN; they only grant it in certain specific and undocumented circumstances.
    - andygambles 14y ago
      With RapidSSL if you order a cert for www.domain.com then it will also cover domain.com. But if you order a cert for domain.com or sub.domain.com then it will NOT secure the www.domain.com. So basically make sure your CSR request is for www.domain.com if you want to also secure the root domain.
mergy 14y ago
The extra cert dialogue box will really drive up traffic. #not
NelsonMinar 14y ago
Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.
- wallunit 14y ago
  Its so impressing how Bing manages to deliver search results as well curated as those from Google. But wait, I just remembered that is because of they rely on search results from Google. ;P http://googleblog.blogspot.de/2011/02/microsofts-bing-uses-google-search.html http://googleblog.blogspot.de/2011/02/microsofts-bing-uses-g...
  - NelsonMinar 14y ago
    If you want to learn more about that event than just a ":P", Danny Sullivan's analysis at the time was excellent: http://searchengineland.com/bing-why-googles-wrong-in-its-accusations-63279 http://searchengineland.com/bing-why-googles-wrong-in-its-ac...
- sixothree 14y ago
  I think it's as simple as having chosen an awful name. Bing is physically difficult to pronounce and it evokes no meaning whatsoever.
  - TallGuyShort 14y ago
    Do you really the pronunciation difficulty and lack of meaning is so significantly different than "Google" was when it launched? It's more vocalized, yes, but only a single syllable for Google's two, and relatively noone actually think of "googolplex" when talking about Google. The sound "bing", I think, conveys speediness, which they took advantage of with the slogan "Bing and decide". It's a quick, sharp sound - as should be your searches.
deleted 14y ago
[deleted]
Osiris 14y ago
This is pretty embarrassing after their Azure SSL certification expirations issues just a month or so ago.
johnchristopher 14y ago
For what it's worth I alawys had problems reaching bing.com when using openDNS.
kylesethgray 14y ago
Looks like it might be related to the reddit DDOS: http://www.reddit.com/r/redditTraffic/comments/1coaer/20130419_crazy_fucking_night/c9igsc4 http://www.reddit.com/r/redditTraffic/comments/1coaer/201304...
- SG- 14y ago
  No.
- wutbrodo 14y ago
  How?
rileytg 14y ago
HA!
SG- 14y ago
bing.com doesn't do SSL, never did except at ssl.bing.com (which doesn't actually do SSL anymore).
zoowar 14y ago
Google should start a "don't get Bingle Berried" campaign like Microsoft's Scroogled.
- psbp 14y ago
  Don't get Fucked in the ass by Microsoft
  - zoowar 14y ago
    No, not that. This => http://www.urbandictionary.com/define.php?term=dingle+berry http://www.urbandictionary.com/define.php?term=dingle+berry
olegbl 14y ago
Neither does Hulu. https://hulu.com/ https://hulu.com/ Amazon redirects to HTTP: https://www.amazon.com/ https://www.amazon.com/ Netflix redirects to HTTP: https://netflix.com/ https://netflix.com/ Etc... Etc... Etc... Why pick on Bing?
- ljd 14y ago
  I understand Hulu and Netflix but I have a hard time understanding why Amazon wouldn't support SSL. It does put a heavier processing load on web servers but you would think that if someone wants to encrypt their shopping traffic Amazon would be open to accommodating that. It is not, by any means, trivial to find out what products someone is looking to buy and could be the basis of a social engineering hack.
- nivla 14y ago
  I wished if Youtube videos were allowed under https. Currently, it just redirects to an error. If it didn't, this will put an end to ISPs throttling the Youtube streaming.
l0c0b0x 14y ago
This just means that there is no redirect on www.bing.com via SSL. Bing.com (ssl) has a proper re-direct to non-ssl www.bing.com. Most-likely an oversight, but it does suggest ssl isn't supported.
lurkinggrue 14y ago
People use bing?

287 points by timthelion 14y ago

casca 14y ago

TL;DR: bing SSL certificate is wrong. https://bing.com https://bing.com: subject=/CN=*.bing.com https://www.bing.com https://www.bing.com: subject=/C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net

ThisIsADogHello 14y ago
Don't forget the X09v3 alternate subject names. https://bing.com/ https://bing.com/ Subject: CN=* .bing.com X509v3 Subject Alternative Name: DNS:ieonline.microsoft.com, DNS:* .bing.com, DNS:* .windowssearch.com -- https://www.bing.com/ https://www.bing.com/ Subject: C=US, O=Akamai Technologies, Inc., CN=a248.e.akamai.net X509v3 Subject Alternative Name: DNS:a248.e.akamai.net, DNS:* .akamaihd.net, DNS:* .akamaihd-staging.net
mrspeaker 14y ago
Wow, that's the first time I've ever seen a 0-word article get the TL;DR treatment.
- return0 14y ago
  Actually the warning message from chrome is pretty lengthy
  - vitorarins 14y ago
    At first I thought it was a joke from Google. Something like: "No you don't want to use bing, here is google."
    - gcb0 14y ago
      ...what kind of massage you received? My browser only talk about the warning, but i only have old chromium... Not auto-updating g chrome
      - piyush_soni 14y ago
        All people giving downvotes to this comment, I think you are being unfair to this person who just seems to have a bad English. He probably meant "message".
        antonpug 14y ago
        lol
        marshray 14y ago
        The medium is the massage. https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage
        gcb0 14y ago
        was typed on swype :) didn't notice the typo
      - derpenxyne 14y ago
        This is the latest message: http://i.imgur.com/ogDhMQp.png http://i.imgur.com/ogDhMQp.png
        3825 14y ago
        back to safety takes me to about:blank Does it take you to https://www.google.com/ https://www.google.com/ ?
- hasenj 14y ago
  TL;DR means "here's a very short explanation".
  - JonnieCache 14y ago
    Who else remembers when it used to be an insult? I preferred it that way.
    - highwind 14y ago
      Yeah. I remember TL;DR meant wall of text, kinda same way RTFM was used. It was a response to something not a tag to indicate what you were doing. How things change so fast on the Internet.
      - azernik 14y ago
        The new meaning is a lot more useful (in the sense that I find lots of opportunities to use it).
        homosaur 14y ago
        Agreed, I still have insults a plenty in my quiver.
      - dragontamer 14y ago
        TL;DR: You prefer the old way of doing things.
  - coin 14y ago
    Why not use the word "summary"?
    - hasenj 14y ago
      I think it's the same reason people write "lol" instead of "hahaha" even though they are not actually laughing out loud. It sounds like internet speek, it's cooler and more 1337.
elliottcarlson 14y ago
We were experiencing a similar issue with a third party analytics solution where their SSL cert all of the sudden started to be delivered by Akamai as opposed to the FQDN of the company, as it was before. I am curious if Akamai is at fault here?
- johngunderman 14y ago
  Was this in the past week? Because just a few days ago I was experiencing a similar problem. I attempted to access https://rememberthemilk.com https://rememberthemilk.com and chrome complained about the SSL cert, as I was receiving the cert for their CDN and not for rememberthemilk itself. I couldn't find anyone that could reproduce the issue, but it occurred consistently on my computer regardless of browser. It resolved itself 20 min after I first noticed it, but I'm still really curious as to why it happened in the first place.
  - elliottcarlson 14y ago
    Yeah - happened on Tuesday and was cleared up the following morning.
  - andygambles 14y ago
    Usually the CDN will have a single certificate which then has multiple SAN entries. What can happen depending on the size of the CDN is it can take a long time for the SSL to be added to the SAN entries on all the edge servers. So if a site just starts moving to a CDN they sometimes jump the gun and instead of waiting for all the edge servers to have the SSL they just change DNS records. You then have a scenario where the DNS is waiting to propagate and the SSL is still propagating around the CDN. Hence you get soem users without a problem, some with and it eventually all clears itself up.
- brokentone 14y ago
  This is Akamai kinda trying to serve HTTPS on domains that don't have HTTPS setup. I'm not sure why they attempt it at all, but it's not really their fault. Same thing on my domain: https://www.theblaze.com/ https://www.theblaze.com/
freehunter 14y ago
Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge security risk, and defeats the purpose of even having an SSL cert. Companies! Make sure your certs are all in order! There's no reason to send a page to your users over HTTPS if they can't trust the certificate. Canonical has been a long-time offender of this, with many of their pages sporting a certificate signed to canonical.com but being served by ubuntu.com.
- T-hawk 14y ago
  > There's no reason to send a page to your users over HTTPS if they can't trust the certificate. There can be. HTTPS still gives you encryption over the wire. It still protects against a passive eavesdropper, like a casual packet sniffer on a public wi-fi network. The whole certificate deal protects against a Mallory with power to intercept and spoof messages. Of course nobody on the public internet can be sure there isn't a Mallory in or at the edge of the user's ISP, but in plenty of intranet or otherwise controlled networking scenarios, HTTPS with certificates lacking a trust chain can be reasonable.
  - ajross 14y ago
    Right. MitM attacks and variants are a proper subset of the mischief that can be achieved with an unsecured connection. Among other things, it's routine that people (hi!) use self-signed certs for personal or temporary TLS sites. I'd be very annoyed to pass a basic-auth-protected https git url to someone for quick-and-mostly-secure read-only access and have their access be denied by a local proxy...
    - freehunter 14y ago
      >I'd be very annoyed to... have their access be denied by a local proxy Untrusted certificate chains is a valid security risk. If it annoys you that users are blocked from viewing your site because you haven't gone through the established and accepted practice of actually completing the SSL trust chain, that's not the local proxy's fault. My number one concern is the integrity and security of my company's data. Your personal or temporary TLS site is much lower down that list, especially if you're serving up untrusted certificates and expecting that users will completely ignore the warnings that try to keep them from falling victim to the kinds of attacks SSL is meant to avoid.
rhplus 14y ago
TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Bing does support SSL on ssl.bing.com and publishes various links on that sub-domain, such as https://ssl.bing.com/webmaster/home/mysites https://ssl.bing.com/webmaster/home/mysites The fact that the https://www.bing.com https://www.bing.com redirects to the HTTP version should be enough to show that this a known, unsupported case on the primary domain. The behavior has been like that for years.
- TazeTSchnitzel 14y ago
  >TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Or use HTTPS Everywhere. Personally, I'd also like it if in future, web browsers would try HTTPS first and HTTP second.
  - deleted 14y ago
    [deleted]
    - decklin 14y ago
      http://en.wikipedia.org/wiki/Server_Name_Indication#Support http://en.wikipedia.org/wiki/Server_Name_Indication#Support
  - wiml 14y ago
    I don't think browsers should assume that http://blahblah http://blahblah and https://blahblah https://blahblah refer to the same resource.
    - ricardobeat 14y ago
      Why not?

Ricapar 14y ago

Looks like someone pushed the wrong SSL cert to production: www.bing.com uses an invalid security certificate. The certificate is only valid for the following names: a248.e.akamai.net , *.akamaihd.net , *.akamaihd-staging.net (Error code: ssl_error_bad_cert_domain)

timthelion 14y ago
http://revealingerrors.com/akamai_ssl http://revealingerrors.com/akamai_ssl
- bshastry 14y ago
  The post does not explain why Akamai's cert is being used. If bing over SSL were working correctly in the past---which I believe to be true---and given that Bing were using Akamai in the past, why the problem now?
  - xonea 14y ago
    nope, bing did not work correctly in the past. A few web searches reveal that it has been like that since at least 2011.
  - SG- 14y ago
    Bing doesn't do SSL and never has at that domain (they previously used ssl.bing.com). you're seeing an Akamai cert because Akamai servers are hosting bing.com.
dominicgs 14y ago
Australian Ebay (https://www.ebay.com.au/ https://www.ebay.com.au/) has had the same problem for months, although I appear to get no response for https://www.ebay.com https://www.ebay.com, so I'm not sure what their policy is on SSL access to the homepage. I expect that Microsoft will fix Bing much more quickly.
- ry0ohki 14y ago

nopal 14y ago

I made a site that checked for SSL cert expirations and misconfigurations, but I couldn't acquire any customers. I still think there's a business there somewhere, although maybe it really only sells as part of another product. Edit: If anyone wants a script to check their certificates, here you go: https://gist.github.com/bretwalker/5420652 https://gist.github.com/bretwalker/5420652. You'll just need to add in some sort of notification logic, especially for expirations, since they need to happen before a problem arises.

simonw 14y ago
Sounds like something you could license to companies to use as a lead generation tool - like HubSpot's Marketing Grader http://marketing.grader.com/ http://marketing.grader.com/
- nopal 14y ago
  That's a very interesting idea, Simon, and one that didn't even cross my mind. I've since moved on to a new project. If anyone wants to talk about taking over the site, shoot me a message at bretwalker /at/ Google's email. It's Django and has some branding and a domain: http://static.nyquistrate.com.s3.amazonaws.com/media/certcian_logo.gif.png http://static.nyquistrate.com.s3.amazonaws.com/media/certcia...
mdmarra 14y ago
The sad thing is that SCOM can monitor for pending certificate expiration and validity. If Microsoft dogfooded a little more, they might have seen this.
aduitsis 14y ago
Which protocols do you support besides https? imap or pop with tls perhaps?
- nopal 14y ago
  Yes, IMAP and POP were supported: https://gist.github.com/bretwalker/5420652 https://gist.github.com/bretwalker/5420652

aaronsnoswell 14y ago

The real question is, why were you on bing? :P

heymishy 14y ago
comment of the day!
- ganarajpr 14y ago
  To Microsoft : Please fix your IE debacle ( somehow!!).. Its affecting your other products.. Its reputation is becoming infectious.
  - webreac 14y ago
    Do you mean Windows 8 debacle ? AFAIK, IE10 is a good browser and IE9 is not so bad.
  - mdmarra 14y ago
    What IE debacle? Trident is now widely considered to have the most correct HTML5 implementation in a major browser. It might not have all of the draft stuff that Webkit has, but it also doesn't require all of the webkit css hacks.
    - theoutlander 14y ago
      Well, it can certainly do a lot better ... check out caniuse.com for more details.
      - mdmarra 14y ago
        I think you missed missed point. Many of the features listed there are draft spec. Rapid adoption of early draft specs are what caused the current Webkit mess. IE 10 doesn't have the most features available, I never said it did. What I did say that that the features that are present are more correctly implemented than other browsers.

atc 14y ago

ssllabs.com

taylorbuley 14y ago

This is the second major flub this year. Azure's cert expired in prod not many weeks ago.

timthelion 14y ago
Actually, it's been like this a really long time. I just noticed, that HN stories which have nondescript titles fare better, so I decided to conduct a little experiment. 1st spot on the front page seems to confirm my hypothesis.
- huhtenberg 14y ago
  Was it you who changed the submission title or was it some mod acting up yet again? The original was interesting and it wasn't factually inaccurate.
  - timthelion 14y ago
    Some mod... I was quite surprised when I saw it.
xonea 14y ago
Well, it is not really a flub of this year. Or even something specific to Bing (try https://www.nba.com/ https://www.nba.com/ or https://www.jetstar.com/ https://www.jetstar.com/) Basically Akamai is using the same ssl certifate on (most?) of its edge servers. The reason for that is that traditionally it is difficult to decide for a server that is serving multiple domains, which SSL certificate to show for a client -- the HTTP header, which contains the hostname is sent way after the certificate information has been exchanged. A certificate can contain several hostnames (in the SubjectAlternativeName extension) - but that does not scale if you have a big number of sites for a number of reasons (re-signing the certificate all the time is a nuisance, browser behavior with certificates containing several thousand hostnames is kind of fun, etc.). Nowadays there are solutions to that problem (using the Server Name Indication TLS extension -- which basically sends the desired hostname in the TLS exchange before the certificate is exchanged). However, the number of sites actively using SNI is very low - google is the only site known to me that is doing it (try accessing google.com with/without SNI and you will get completely different certificates). The reason why SNI is not yet that much used is that client support is still a bit flaky. Afaik it is supported by all recent desktop browsers. However, I think the XP TLS stack does not support it (and there are still enough users on that), android only supports it starting with version 3.0, etc. So - at the moment you basically still need a separate IP for each site (or at least one IP for sites that can share one certificate). I don't know if akamai also supports custom SSL certificates. Facebook seems to use kind of an interesting mix between akamai and self-hosting - facebook.com itself seems to be hosted by facebook. However, if you use facebook over ssl and check the url of served profile pictures, you will see that they go to https://fbcdn-profile-a.akamaihd.net https://fbcdn-profile-a.akamaihd.net (or similar) -- hence to one of the hostnames that is mentioned in the akamai edge certificates.

Y0L0 14y ago

I sincerely hope that this not some sick and twisted joke by Microsoft.

theycallmemorty 14y ago
I think you're in the clear.

deepblueocean 14y ago

Wow. This has been going on for an hour now. It's such a simple fix, especially since one would assume that they already have a valid cert somewhere (or that Akamai does). Yet they've had an hour of SSL downtime. Does anyone know if Bing has any SSL-only clients? Like do any of their toolbars or built-in search widgets in Windows use SSL by default?

xonea 14y ago
This is not new and probably will not be fixed fast - the situation has been like that (unchanged) since at least 2011.
Trufa 14y ago
Easy fix? What the hell? I don't like or use Bing services but when you get as big and complex as Bing, nothing is easy, it's not like you can open your text editor, modify one line, commit and push. There so many other variables to take into consideration, by hurrying to fix, you could face all sort of vulnerabilities / other issues. I'm not saying this error is acceptable, I'm saying it's ridiculous to say it's and easy fix without actually knowing anything, it might or it might now.
timthelion 14y ago
See https://news.ycombinator.com/item?id=5576342 https://news.ycombinator.com/item?id=5576342
bcoates 14y ago
I think it's always been like this. Bing has never run over https as far as I can tell.
ricardobeat 14y ago
According to MS guys this is not an error, SSL is supported at https://ssl.bing.com/ https://ssl.bing.com/ which is what their tools use.

smackfu 14y ago

Bing is normally not served over https, so this probably only affects a tiny percentage of the users, even though it looks bad here.

tosseraccount 14y ago

Short Microsoft. 25000 more employees can't fix this kind of incompetence.

ccarter84 14y ago
There's gotta be some kind of organizational size:responsiveness inverse metric for stuff like this

bwooceli 14y ago

back up as of 8:42 CST

joshstrange 14y ago
I'm still seeing it 9:50 EST

a_1 14y ago

why would you use bing?

LTheobald 14y ago

It's not just Bing. I'm always accidentally going to http://stackoverflow.com http://stackoverflow.com & getting an error.

benparsons 14y ago
I don't understand - that's never resulted in an error for me.
- jsight 14y ago
  Maybe he meant https://stackoverflow.com/ https://stackoverflow.com/ ?
  - mikeash 14y ago
    Wow, that's just terrible.
rschmitty 14y ago
Shh, only MS bashing can go on in this thread
- jonknee 14y ago
  SO uses a MS stack so it's not too far off...

pasbesoin 14y ago

Why should we take Microsoft's Internet efforts seriously when they continue, perpetually, not to do so, themselves? (Actions speak louder than words.)

mekoka 14y ago

The real question is, is bing.com even supposed to be served over https?

city41 14y ago
why wouldn't you want to serve it over SSL?
sdfjkl 14y ago
With very few exceptions, everything is supposed to be served over HTTPS (or other secure protocols). Certainly something as sensitive as search traffic. Tell me your search queries and I'll tell you your interests, health problems, relationships, if you're happy in your job and what kind of porn you like.
- ccarter84 14y ago
  That last one is where they get ya

icecreamguy 14y ago

I've gotten a certificate error for over a year with Bing on HTTPS. I always just assumed that they, somewhat surprisingly, just didn't support HTTPS yet.

webignition 14y ago

Slightly off-topic: what's a good way to handle cases such as this where you have a wildcard certificate? I'll be getting a wildcard certificate for a project and, never having used one before, I had assumed the certificate would be valid for an entire domain. I understand from this situation that a wildcard certificate is relevant only to https://*.example.com https://*.example.com and not the subdomainless https://example.com https://example.com. Assuming that to be the case, is having a wildcard certificate for *.example.com and a second certificate for example.com the solution? It'd be nice to have the entire domain covered by a wildcard certificate and not just all subdomains.

phlo 14y ago
Not all that off-topic. For your example, you should get a certificate made out to ("Subject CN") example.com or * .example.com, then list both the wildcard and the subdomainless entry as Subject Alternative Names. Bing is doing something similar (see https://news.ycombinator.com/item?id=5576271 https://news.ycombinator.com/item?id=5576271), but they appear to have forgotten to list the plain domain.
klapinat0r 14y ago
Typically a certificate issuer will grant you both when you buy a wildcard one. This can be achieved via SAN (alternative names): http://en.wikipedia.org/wiki/Wildcard_certificate#Limitation http://en.wikipedia.org/wiki/Wildcard_certificate#Limitation
- vsync 14y ago
  Comodo's been good to me in this regard. Incidentally, beware of RapidSSL and their "free www." SAN; they only grant it in certain specific and undocumented circumstances.
  - andygambles 14y ago
    With RapidSSL if you order a cert for www.domain.com then it will also cover domain.com. But if you order a cert for domain.com or sub.domain.com then it will NOT secure the www.domain.com. So basically make sure your CSR request is for www.domain.com if you want to also secure the root domain.

mergy 14y ago

The extra cert dialogue box will really drive up traffic. #not

NelsonMinar 14y ago

Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.

wallunit 14y ago
Its so impressing how Bing manages to deliver search results as well curated as those from Google. But wait, I just remembered that is because of they rely on search results from Google. ;P http://googleblog.blogspot.de/2011/02/microsofts-bing-uses-google-search.html http://googleblog.blogspot.de/2011/02/microsofts-bing-uses-g...
- NelsonMinar 14y ago
  If you want to learn more about that event than just a ":P", Danny Sullivan's analysis at the time was excellent: http://searchengineland.com/bing-why-googles-wrong-in-its-accusations-63279 http://searchengineland.com/bing-why-googles-wrong-in-its-ac...
sixothree 14y ago
I think it's as simple as having chosen an awful name. Bing is physically difficult to pronounce and it evokes no meaning whatsoever.
- TallGuyShort 14y ago
  Do you really the pronunciation difficulty and lack of meaning is so significantly different than "Google" was when it launched? It's more vocalized, yes, but only a single syllable for Google's two, and relatively noone actually think of "googolplex" when talking about Google. The sound "bing", I think, conveys speediness, which they took advantage of with the slogan "Bing and decide". It's a quick, sharp sound - as should be your searches.

deleted 14y ago

[deleted]

Osiris 14y ago

This is pretty embarrassing after their Azure SSL certification expirations issues just a month or so ago.

johnchristopher 14y ago

For what it's worth I alawys had problems reaching bing.com when using openDNS.

kylesethgray 14y ago

Looks like it might be related to the reddit DDOS: http://www.reddit.com/r/redditTraffic/comments/1coaer/20130419_crazy_fucking_night/c9igsc4 http://www.reddit.com/r/redditTraffic/comments/1coaer/201304...

SG- 14y ago
No.
wutbrodo 14y ago
How?

rileytg 14y ago

HA!

SG- 14y ago

bing.com doesn't do SSL, never did except at ssl.bing.com (which doesn't actually do SSL anymore).

zoowar 14y ago

Google should start a "don't get Bingle Berried" campaign like Microsoft's Scroogled.

psbp 14y ago
Don't get Fucked in the ass by Microsoft
- zoowar 14y ago
  No, not that. This => http://www.urbandictionary.com/define.php?term=dingle+berry http://www.urbandictionary.com/define.php?term=dingle+berry

olegbl 14y ago

Neither does Hulu. https://hulu.com/ https://hulu.com/ Amazon redirects to HTTP: https://www.amazon.com/ https://www.amazon.com/ Netflix redirects to HTTP: https://netflix.com/ https://netflix.com/ Etc... Etc... Etc... Why pick on Bing?

ljd 14y ago
I understand Hulu and Netflix but I have a hard time understanding why Amazon wouldn't support SSL. It does put a heavier processing load on web servers but you would think that if someone wants to encrypt their shopping traffic Amazon would be open to accommodating that. It is not, by any means, trivial to find out what products someone is looking to buy and could be the basis of a social engineering hack.
nivla 14y ago
I wished if Youtube videos were allowed under https. Currently, it just redirects to an error. If it didn't, this will put an end to ISPs throttling the Youtube streaming.

l0c0b0x 14y ago

This just means that there is no redirect on www.bing.com via SSL. Bing.com (ssl) has a proper re-direct to non-ssl www.bing.com. Most-likely an oversight, but it does suggest ssl isn't supported.

lurkinggrue 14y ago

People use bing?