4

The meta link on the main page points to https://money.meta.stackexchange.com/ . When I go to that URL, I get a "403 Forbidden" error. I had a friend check this from another computer and he got the same result.

Is anyone else getting this? Can it be fixed? I'm guessing it's a problem with the SSL certificate, because using http:// instead of https:// works, but I'm not sure how to proceed.

  • Where's the link? When I follow the one in the Help menu I see a link to the http site. Maybe it was changed back already. When I visit the https site I get a certificate error because the certificate being provided was issued to the web accelerator (cloudfare) rather than to stackexchange. Apparently a year ago https support was still "partial": meta.stackexchange.com/questions/226030/… so I guess this isn't intended to work yet. – Ganesh Sittampalam♦ Nov 24 '15 at 6:10
  • @GaneshSittampalam: Hmmm, I was following the link in the Help menu. It seems that if you visit the main site on https, the meta link is also https, whereas it's http if you visit main site on http. Either way it seems like something is wrong, though, because visiting the main site on https works and visiting meta on https doesn't. – BrenBarn Nov 24 '15 at 6:12
  • Why are you adding the S? https? I am asking how or why one would attempt that address? Any links from the site itself wouldn't have the S. – JoeTaxpayer♦ Nov 24 '15 at 12:48
  • @JoeTaxpayer: To be honest, I don't know how it got there. The reason I have it now is that somehow the autocomplete for the main site in my browser history has the S in it. Presumably at some point I followed a link from who knows where. And, as I mentioned, if you visit the main site on HTTPS, the meta site link also is to HTTPS. – BrenBarn Nov 24 '15 at 18:17
3

This is working as intended, for now. Officially, we do not fully support https access yet, and none of our certificates are valid for meta sites. You can get a full explanation of that by Adam Lear on our main meta:

... you can't have a wildcard in the middle of a cert, so meta.*.stackexchange.com could never be a thing and we're not about to start registering/maintaining 100+ certs.

So. We're working on moving meta sites to a different URL scheme (*.meta.stackexchange.com) to get around this. ...

We do only display https links if you're visiting the site in https already, and we realize that this pretty much breaks Meta for the unsuspecting users. For now, the only solution we can really offer is to add an exception for the Meta sites you regularly visit so that it doesn't interrupt your normal activity if you're browsing on https, at least until we get around to fixing this issue and pushing out full support for it. We can't exactly change the link to the non-https version because that would sort of break the excepted result for users who have added such exceptions and expect to still be browsing a secure version of the site.

As far as the 403 Forbidden, this is a CloudFlare issue, and I'll ask around to see why that is showing up again.

  • You say "working as intended", but then at the end you seem to say the 403 Forbidden is not intended. The way it is currently "working" is you get a 403 Forbidden, so what do you mean is the intended behavior? – BrenBarn Nov 24 '15 at 6:44
  • I thought we changed something in CloudFlare to prevent that, but it's very possible it's by-design until full support is pushed. – animuson♦ Nov 24 '15 at 6:47
  • If that's by design, that seems like a pretty bad design choice. At the least, can't there be a real error page that explicitly says "HTTPS is not supported yet"? The existing error page is totally generic and totally uninformative. If HTTPS isn't supported, it should either fail like it does on any site that doesn't support HTTPS at all (e.g., with a "this site can't be reached" due to unsupported protocol), or it should fail nicely with a message telling you what to do instead. – BrenBarn Nov 24 '15 at 6:56
  • That error page is served by CloudFlare itself though, so I'm not sure how much control we actually have over it. It's basically a page saying CloudFlare couldn't access our site because of the invalid security certificates, so it can't show you anything; and unfortunately they use it as a bit of a catch-all. – animuson♦ Nov 24 '15 at 7:01
  • 1
    Interesting. I see now that I'm actually getting two different pages seemingly at random. One is a bare page that just says "403 forbidden" and then "cloudflare-nginx". The other is a more informative page with an "Error 526: Invalid SSL Certificate" and some other stuff. Given that you guys are presumably paying CloudFlare a pretty penny to handle huge traffic loads, it seems like you might be able to work something out so site users don't see bare-bones error pages that give a bad impression. But anyway, thanks for your responsiveness on this. Hopefully real HTTPS support will come soon. – BrenBarn Nov 24 '15 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .