6 ms·

TL;DR: bing SSL certificate is wrong. https://bing.com https://bing.com: subject=/CN=*.bing.com https://www.bing.com https://www.bing.com: subject=/C=US/O=Aka

by casca 13y ago

TL;DR: bing SSL certificate is wrong. https://bing.com https://bing.com: subject=/CN=*.bing.com https://www.bing.com https://www.bing.com: subject=/C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net

ThisIsADogHello 13y ago
Don't forget the X09v3 alternate subject names. https://bing.com/ https://bing.com/ Subject: CN=* .bing.com X509v3 Subject Alternative Name: DNS:ieonline.microsoft.com, DNS:* .bing.com, DNS:* .windowssearch.com -- https://www.bing.com/ https://www.bing.com/ Subject: C=US, O=Akamai Technologies, Inc., CN=a248.e.akamai.net X509v3 Subject Alternative Name: DNS:a248.e.akamai.net, DNS:* .akamaihd.net, DNS:* .akamaihd-staging.net
mrspeaker 13y ago
Wow, that's the first time I've ever seen a 0-word article get the TL;DR treatment.
- return0 13y ago
  Actually the warning message from chrome is pretty lengthy
  - vitorarins 13y ago
    At first I thought it was a joke from Google. Something like: "No you don't want to use bing, here is google."
    - gcb0 13y ago
      ...what kind of massage you received? My browser only talk about the warning, but i only have old chromium... Not auto-updating g chrome
      - piyush_soni 13y ago
        All people giving downvotes to this comment, I think you are being unfair to this person who just seems to have a bad English. He probably meant "message".
        antonpug 13y ago
        lol
        marshray 13y ago
        The medium is the massage. https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage
        gcb0 13y ago
        was typed on swype :) didn't notice the typo
      - derpenxyne 13y ago
        This is the latest message: http://i.imgur.com/ogDhMQp.png http://i.imgur.com/ogDhMQp.png
        3825 13y ago
        back to safety takes me to about:blank Does it take you to https://www.google.com/ https://www.google.com/ ?
- hasenj 13y ago
  TL;DR means "here's a very short explanation".
  - JonnieCache 13y ago
    Who else remembers when it used to be an insult? I preferred it that way.
    - highwind 13y ago
      Yeah. I remember TL;DR meant wall of text, kinda same way RTFM was used. It was a response to something not a tag to indicate what you were doing. How things change so fast on the Internet.
      - azernik 13y ago
        The new meaning is a lot more useful (in the sense that I find lots of opportunities to use it).
        homosaur 13y ago
        Agreed, I still have insults a plenty in my quiver.
      - dragontamer 13y ago
        TL;DR: You prefer the old way of doing things.
  - coin 13y ago
    Why not use the word "summary"?
    - hasenj 13y ago
      I think it's the same reason people write "lol" instead of "hahaha" even though they are not actually laughing out loud. It sounds like internet speek, it's cooler and more 1337.
elliottcarlson 13y ago
We were experiencing a similar issue with a third party analytics solution where their SSL cert all of the sudden started to be delivered by Akamai as opposed to the FQDN of the company, as it was before. I am curious if Akamai is at fault here?
- johngunderman 13y ago
  Was this in the past week? Because just a few days ago I was experiencing a similar problem. I attempted to access https://rememberthemilk.com https://rememberthemilk.com and chrome complained about the SSL cert, as I was receiving the cert for their CDN and not for rememberthemilk itself. I couldn't find anyone that could reproduce the issue, but it occurred consistently on my computer regardless of browser. It resolved itself 20 min after I first noticed it, but I'm still really curious as to why it happened in the first place.
  - elliottcarlson 13y ago
    Yeah - happened on Tuesday and was cleared up the following morning.
  - andygambles 13y ago
    Usually the CDN will have a single certificate which then has multiple SAN entries. What can happen depending on the size of the CDN is it can take a long time for the SSL to be added to the SAN entries on all the edge servers. So if a site just starts moving to a CDN they sometimes jump the gun and instead of waiting for all the edge servers to have the SSL they just change DNS records. You then have a scenario where the DNS is waiting to propagate and the SSL is still propagating around the CDN. Hence you get soem users without a problem, some with and it eventually all clears itself up.
- brokentone 13y ago
  This is Akamai kinda trying to serve HTTPS on domains that don't have HTTPS setup. I'm not sure why they attempt it at all, but it's not really their fault. Same thing on my domain: https://www.theblaze.com/ https://www.theblaze.com/
freehunter 13y ago
Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge security risk, and defeats the purpose of even having an SSL cert. Companies! Make sure your certs are all in order! There's no reason to send a page to your users over HTTPS if they can't trust the certificate. Canonical has been a long-time offender of this, with many of their pages sporting a certificate signed to canonical.com but being served by ubuntu.com.
- T-hawk 13y ago
  > There's no reason to send a page to your users over HTTPS if they can't trust the certificate. There can be. HTTPS still gives you encryption over the wire. It still protects against a passive eavesdropper, like a casual packet sniffer on a public wi-fi network. The whole certificate deal protects against a Mallory with power to intercept and spoof messages. Of course nobody on the public internet can be sure there isn't a Mallory in or at the edge of the user's ISP, but in plenty of intranet or otherwise controlled networking scenarios, HTTPS with certificates lacking a trust chain can be reasonable.
  - ajross 13y ago
    Right. MitM attacks and variants are a proper subset of the mischief that can be achieved with an unsecured connection. Among other things, it's routine that people (hi!) use self-signed certs for personal or temporary TLS sites. I'd be very annoyed to pass a basic-auth-protected https git url to someone for quick-and-mostly-secure read-only access and have their access be denied by a local proxy...
    - freehunter 13y ago
      >I'd be very annoyed to... have their access be denied by a local proxy Untrusted certificate chains is a valid security risk. If it annoys you that users are blocked from viewing your site because you haven't gone through the established and accepted practice of actually completing the SSL trust chain, that's not the local proxy's fault. My number one concern is the integrity and security of my company's data. Your personal or temporary TLS site is much lower down that list, especially if you're serving up untrusted certificates and expecting that users will completely ignore the warnings that try to keep them from falling victim to the kinds of attacks SSL is meant to avoid.
rhplus 13y ago
TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Bing does support SSL on ssl.bing.com and publishes various links on that sub-domain, such as https://ssl.bing.com/webmaster/home/mysites https://ssl.bing.com/webmaster/home/mysites The fact that the https://www.bing.com https://www.bing.com redirects to the HTTP version should be enough to show that this a known, unsupported case on the primary domain. The behavior has been like that for years.
- TazeTSchnitzel 13y ago
  >TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Or use HTTPS Everywhere. Personally, I'd also like it if in future, web browsers would try HTTPS first and HTTP second.
  - deleted 13y ago
    [deleted]
    - decklin 13y ago
      http://en.wikipedia.org/wiki/Server_Name_Indication#Support http://en.wikipedia.org/wiki/Server_Name_Indication#Support
  - wiml 13y ago
    I don't think browsers should assume that http://blahblah http://blahblah and https://blahblah https://blahblah refer to the same resource.
    - ricardobeat 13y ago
      Why not?

by casca 13y ago

ThisIsADogHello 13y ago

Don't forget the X09v3 alternate subject names. https://bing.com/ https://bing.com/ Subject: CN=* .bing.com X509v3 Subject Alternative Name: DNS:ieonline.microsoft.com, DNS:* .bing.com, DNS:* .windowssearch.com -- https://www.bing.com/ https://www.bing.com/ Subject: C=US, O=Akamai Technologies, Inc., CN=a248.e.akamai.net X509v3 Subject Alternative Name: DNS:a248.e.akamai.net, DNS:* .akamaihd.net, DNS:* .akamaihd-staging.net

mrspeaker 13y ago

Wow, that's the first time I've ever seen a 0-word article get the TL;DR treatment.

return0 13y ago
Actually the warning message from chrome is pretty lengthy
- vitorarins 13y ago
  At first I thought it was a joke from Google. Something like: "No you don't want to use bing, here is google."
  - gcb0 13y ago
    ...what kind of massage you received? My browser only talk about the warning, but i only have old chromium... Not auto-updating g chrome
    - piyush_soni 13y ago
      All people giving downvotes to this comment, I think you are being unfair to this person who just seems to have a bad English. He probably meant "message".
      - antonpug 13y ago
        lol
      - marshray 13y ago
        The medium is the massage. https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage https://en.wikipedia.org/wiki/The_Medium_Is_The_Massage
      - gcb0 13y ago
        was typed on swype :) didn't notice the typo
    - derpenxyne 13y ago
      This is the latest message: http://i.imgur.com/ogDhMQp.png http://i.imgur.com/ogDhMQp.png
      - 3825 13y ago
        back to safety takes me to about:blank Does it take you to https://www.google.com/ https://www.google.com/ ?
hasenj 13y ago
TL;DR means "here's a very short explanation".
- JonnieCache 13y ago
  Who else remembers when it used to be an insult? I preferred it that way.
  - highwind 13y ago
    Yeah. I remember TL;DR meant wall of text, kinda same way RTFM was used. It was a response to something not a tag to indicate what you were doing. How things change so fast on the Internet.
    - azernik 13y ago
      The new meaning is a lot more useful (in the sense that I find lots of opportunities to use it).
      - homosaur 13y ago
        Agreed, I still have insults a plenty in my quiver.
    - dragontamer 13y ago
      TL;DR: You prefer the old way of doing things.
- coin 13y ago
  Why not use the word "summary"?
  - hasenj 13y ago
    I think it's the same reason people write "lol" instead of "hahaha" even though they are not actually laughing out loud. It sounds like internet speek, it's cooler and more 1337.

elliottcarlson 13y ago

We were experiencing a similar issue with a third party analytics solution where their SSL cert all of the sudden started to be delivered by Akamai as opposed to the FQDN of the company, as it was before. I am curious if Akamai is at fault here?

johngunderman 13y ago
Was this in the past week? Because just a few days ago I was experiencing a similar problem. I attempted to access https://rememberthemilk.com https://rememberthemilk.com and chrome complained about the SSL cert, as I was receiving the cert for their CDN and not for rememberthemilk itself. I couldn't find anyone that could reproduce the issue, but it occurred consistently on my computer regardless of browser. It resolved itself 20 min after I first noticed it, but I'm still really curious as to why it happened in the first place.
- elliottcarlson 13y ago
  Yeah - happened on Tuesday and was cleared up the following morning.
- andygambles 13y ago
  Usually the CDN will have a single certificate which then has multiple SAN entries. What can happen depending on the size of the CDN is it can take a long time for the SSL to be added to the SAN entries on all the edge servers. So if a site just starts moving to a CDN they sometimes jump the gun and instead of waiting for all the edge servers to have the SSL they just change DNS records. You then have a scenario where the DNS is waiting to propagate and the SSL is still propagating around the CDN. Hence you get soem users without a problem, some with and it eventually all clears itself up.
brokentone 13y ago
This is Akamai kinda trying to serve HTTPS on domains that don't have HTTPS setup. I'm not sure why they attempt it at all, but it's not really their fault. Same thing on my domain: https://www.theblaze.com/ https://www.theblaze.com/

freehunter 13y ago

Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge security risk, and defeats the purpose of even having an SSL cert. Companies! Make sure your certs are all in order! There's no reason to send a page to your users over HTTPS if they can't trust the certificate. Canonical has been a long-time offender of this, with many of their pages sporting a certificate signed to canonical.com but being served by ubuntu.com.

T-hawk 13y ago
> There's no reason to send a page to your users over HTTPS if they can't trust the certificate. There can be. HTTPS still gives you encryption over the wire. It still protects against a passive eavesdropper, like a casual packet sniffer on a public wi-fi network. The whole certificate deal protects against a Mallory with power to intercept and spoof messages. Of course nobody on the public internet can be sure there isn't a Mallory in or at the edge of the user's ISP, but in plenty of intranet or otherwise controlled networking scenarios, HTTPS with certificates lacking a trust chain can be reasonable.
- ajross 13y ago
  Right. MitM attacks and variants are a proper subset of the mischief that can be achieved with an unsecured connection. Among other things, it's routine that people (hi!) use self-signed certs for personal or temporary TLS sites. I'd be very annoyed to pass a basic-auth-protected https git url to someone for quick-and-mostly-secure read-only access and have their access be denied by a local proxy...
  - freehunter 13y ago
    >I'd be very annoyed to... have their access be denied by a local proxy Untrusted certificate chains is a valid security risk. If it annoys you that users are blocked from viewing your site because you haven't gone through the established and accepted practice of actually completing the SSL trust chain, that's not the local proxy's fault. My number one concern is the integrity and security of my company's data. Your personal or temporary TLS site is much lower down that list, especially if you're serving up untrusted certificates and expecting that users will completely ignore the warnings that try to keep them from falling victim to the kinds of attacks SSL is meant to avoid.

rhplus 13y ago

TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Bing does support SSL on ssl.bing.com and publishes various links on that sub-domain, such as https://ssl.bing.com/webmaster/home/mysites https://ssl.bing.com/webmaster/home/mysites The fact that the https://www.bing.com https://www.bing.com redirects to the HTTP version should be enough to show that this a known, unsupported case on the primary domain. The behavior has been like that for years.

TazeTSchnitzel 13y ago
>TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com https://www.bing.com into the address bar to generate this 'error'. Or use HTTPS Everywhere. Personally, I'd also like it if in future, web browsers would try HTTPS first and HTTP second.
- deleted 13y ago
  [deleted]
  - decklin 13y ago
    http://en.wikipedia.org/wiki/Server_Name_Indication#Support http://en.wikipedia.org/wiki/Server_Name_Indication#Support
- wiml 13y ago
  I don't think browsers should assume that http://blahblah http://blahblah and https://blahblah https://blahblah refer to the same resource.
  - ricardobeat 13y ago
    Why not?