3 ms·

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after

by luma 13y ago

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after patching impacted OpenSSL instances. It looks like they instead have switched over to a previously-issued wildcard cert for *.stackexchange.com. The cert is valid, but it's for the wrong domain. This is more likely the result of a sysadmin screwing up the response and not bothering to check the work. Maybe s/he should post on stackexchange for some help :D

gourlaysama 13y ago
This seems to be the most likely explanation. Serverfault [1] also has switched to that same certificate. [1] https://serverfault.com/ https://serverfault.com/
Nick-Craver 13y ago
We are actually waiting on a re-issue of a combined wildcard at the moment, but as DNS propagates you'll be served a previous, still valid cert in the interim. We hope to get the final cert deployed within the hour...as soon as we have it in hand. Our other certs are queued up and ready to do on a secondary load balancer. CAs are understandably a bit busier than normal today.
- spolsky 13y ago
  n.b. Nick is a Stack Exchange system administrator
toomuchtodo 13y ago
> This is more likely the result of a sysadmin screwing up the response and not bothering to check the work. As an experienced operations/admin individual, I'd ask for a little courtesy for them. Screwing up the response? Possible. But in some cases, our options are few, and the one that provides the least breakage is what we roll with. Sometimes, there aren't any other options. TL;DR Sometimes, we have to break shit to make it work, but its less broken than before.
AjithAntony 13y ago
Maybe the cert was different before this moment, but yeah, the CN is *.stackexchange.com, but it has suitable Subject Alternative Names for the other domains.

by luma 13y ago

gourlaysama 13y ago

This seems to be the most likely explanation. Serverfault [1] also has switched to that same certificate. [1] https://serverfault.com/ https://serverfault.com/

Nick-Craver 13y ago

We are actually waiting on a re-issue of a combined wildcard at the moment, but as DNS propagates you'll be served a previous, still valid cert in the interim. We hope to get the final cert deployed within the hour...as soon as we have it in hand. Our other certs are queued up and ready to do on a secondary load balancer. CAs are understandably a bit busier than normal today.

spolsky 13y ago
n.b. Nick is a Stack Exchange system administrator

toomuchtodo 13y ago

> This is more likely the result of a sysadmin screwing up the response and not bothering to check the work. As an experienced operations/admin individual, I'd ask for a little courtesy for them. Screwing up the response? Possible. But in some cases, our options are few, and the one that provides the least breakage is what we roll with. Sometimes, there aren't any other options. TL;DR Sometimes, we have to break shit to make it work, but its less broken than before.

AjithAntony 13y ago

Maybe the cert was different before this moment, but yeah, the CN is *.stackexchange.com, but it has suitable Subject Alternative Names for the other domains.