Bing doesn't support SSL • Hacker News Board

Re: Bing doesn't support SSL

#161

Post by andygambles » Thu, Apr 25, 2013, 9:31 AM UTC

johngunderman wrote: post #67

elliottcarlson wrote: post #60

Earlier quoted context omitted.

We were experiencing a similar issue with a third party analytics solution where their SSL cert all of the sudden started to be delivered by Akamai as opposed to the FQDN of the company, as it was before. I am curious if Akamai is at fault here?

Was this in the past week? Because just a few days ago I was experiencing a similar problem. I attempted to access https://rememberthemilk.com and chrome complained about the SSL cert, as I was receiving the cert for their CDN and not for rememberthemilk itself. I couldn't find anyone that could reproduce the issue, but it occurred consistently on my computer regardless of browser. It resolved itself 20 min after I f…

Usually the CDN will have a single certificate which then has multiple SAN entries. What can happen depending on the size of the CDN is it can take a long time for the SSL to be added to the SAN entries on all the edge servers. So if a site just starts moving to a CDN they sometimes jump the gun and instead of waiting for all the edge servers to have the SSL they just change DNS records.

You then have a scenario where the DNS is waiting to propagate and the SSL is still propagating around the CDN. Hence you get soem users without a problem, some with and it eventually all clears itself up.

Re: Bing doesn't support SSL

#162

Post by andygambles » Thu, Apr 25, 2013, 9:36 AM UTC

vsync wrote: post #108

klapinat0r wrote: post #65

Earlier quoted context omitted.

Typically a certificate issuer will grant you both when you buy a wildcard one. This can be achieved via SAN (alternative names): http://en.wikipedia.org/wiki/Wildcard_certificate#Limitation

Comodo's been good to me in this regard. Incidentally, beware of RapidSSL and their "free www." SAN; they only grant it in certain specific and undocumented circumstances.

With RapidSSL if you order a cert for www.domain.com then it will also cover domain.com. But if you order a cert for domain.com or sub.domain.com then it will NOT secure the www.domain.com.

So basically make sure your CSR request is for www.domain.com if you want to also secure the root domain.

Re: Bing doesn't support SSL

#163

Post by vsync » Wed, May 08, 2013, 8:03 PM UTC

andygambles wrote: post #162

vsync wrote: post #108

Earlier quoted context omitted.

Comodo's been good to me in this regard. Incidentally, beware of RapidSSL and their "free www." SAN; they only grant it in certain specific and undocumented circumstances.

With RapidSSL if you order a cert for www.domain.com then it will also cover domain.com. But if you order a cert for domain.com or sub.domain.com then it will NOT secure the www.domain.com. So basically make sure your CSR request is for www.domain.com if you want to also secure the root domain.

Bizarrely, this only works for second-level domains however, and isn't disclosed in advance.

Really, CAs shouldn't be throwing in "free bonus" SANs without customer authorization ever. It would be much better to have a place to enter the SANs, or a checkbox asking if I want "www." as well, or to apply to the parent also, or whatever. That would also make the process more apparent to the user in addition to being more secure.