News for hackers. Stuff that matters.

A comment on Improved Digital Certificate Security. Parent comment

Re:Improved Digital Certificate Security by captn3m0 on Sunday September 20, 2015 @02:24AM (#10246740)
Disable HTTPS-Everywhere for the site if you have that installed. Took me quite a while to figure out.
[ Parent | on HN ]
Re:Improved Digital Certificate Security by newjersey on Sunday September 20, 2015 @08:28AM (#10247273)
Why does the https redirect to http? Symantec can't afford to give itself a certificate?

the java server pages application that serves the main site has extended validation https://www.symantec.com/index.jsp

but connect doesn't. It seems like https://www.symantec.com/connect/ redirects to http://www.symantec.com/connect/

r.port="https"===o[0]?"443":"80"

Why can't Symantec afford to put ssl on its connect site? It is not like they have to pay anyone for a certificate...

[ Parent | on HN ]
Re:Improved Digital Certificate Security by StavrosK on Sunday September 20, 2015 @09:01AM (#10247354)
Not even that, the domain already has a certificate, they're forcing a redirect to HTTP on a domain that already has a certificate.
[ Parent | on HN ]