1
$\begingroup$

Whenever I click a hyperlink to meta.PSE (as posted by e.g. the "Physics Meta" bot) in the h bar, I get the following screen:

enter image description here

When I choose to proceed anyways (bottom hyperlink), I get this:

enter image description here

Note that the URL looks like this:

enter image description here

Some other times, I just immediately get this screen:

enter image description here

I do manage to get to the correct page by simply deleting the https:// part of the URL and pressing enter. What's going wrong? For reference, I'm on Windows 10, using Google Chrome.

$\endgroup$
  • $\begingroup$ Can you point to a specific example of a link on h bar to https://meta.*? The https on meta issue is well known, but there's no reason for links on chat to go there, particularly if they've been automatically generated, and it's not like people would be copy-pasting from their address bar. $\endgroup$ – Emilio Pisanty Apr 27 '16 at 12:03
3
$\begingroup$

This problem is well known, and has been for years. The problem is simply that you cannot access any Stack Exchange meta sites using HTTPS. It has nothing to do with chat, or your browser.

In detail, in order to access a site using HTTPS (an encrypted connection), the site needs to provide a certificate which contains the site's name, an associated encryption key, and a certification that these values are associated with each other. The certificate specification allows a single leading wildcard; for example, it's possible to make a certificate that gives one encryption key to be used by any domain of the form *.stackexchange.com (where * can be anything). But it's not possible to make a certificate that can be used by meta.*.stackexchange.com, or *.*.stackexchange.com, which is what would be needed to make the meta sites accessible over HTTPS. The certification process StackExchange uses is expensive, and they understandably don't want to go through it to get a separate certificate for each meta site.

Until Stack Exchange changes their site architecture to solve the problem (if they ever do), a workaround may be to use the HTTPS Everywhere extension, if it's available for your browser. Its main purpose is to enforce HTTPS usage; it prevents your browser from making unencrypted connections to certain sites which are known to work with HTTPS. But as a side effect, I believe it also prevents the browser from making encrypted connections to a few sites which are known not to work with HTTPS, including the SE meta sites.

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .