News for hackers. Stuff that matters.

A comment on Offshoring roulette: lessons from outsourcing (2016). Parent comment

Re:Offshoring roulette: lessons from outsourcing (2016) by _JC_Denton on Monday February 24, 2020 @07:31PM (#22409855)
Heads up - I am getting an invalid certificate warning in your site. iOS Safari.
[ Parent | on HN ]
Re:Offshoring roulette: lessons from outsourcing (2016) by cpeterso on Monday February 24, 2020 @07:47PM (#22409950)
And in Firefox:

"Firefox does not trust this site because it uses a certificate that is not valid for magmalabs.io. The certificate is only valid for the following names: m.magmalabs.io, www.magmalabs.io

Error code: SSL_ERROR_BAD_CERT_DOMAIN

https://magmalabs.io/ produces the error. https://www.magmalabs.io/ does not. https://magmalabs.io/ works in Chrome. Does Chrome delay the certificate validity check until after the HTTP redirect?

[ Parent | on HN ]
Re:Offshoring roulette: lessons from outsourcing (2016) by cpeterso on Wednesday February 26, 2020 @11:16AM (#22424305)
I filed a Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1617987

Chrome has a heuristic they call SSLCommonNameMismatchHandling: if Chrome tries to connect to a site like "https://example.com" but the returned cert is for the "www." subdomain of the same domain, Chrome will silently redirect to "https://www.example.com".

[ Parent | on HN ]