TLS certificates or server misconfig?

[sweh]

These days browsers are starting to default to https; so if a user types "x.y.example.com" then the browser will try to go to "https://x.y.example.com".

Why does this matter to us? Because this server hosts various sites, and their TLS cert doesn't match or there isn't a vhost config for them.

e.g bbcmicro.co.uk; if a user just types that into the address bar (at least with chrome) then it gives the cert mismatch error page:

If I click through then I get the stardot home page and not bbcmicro.co.uk

Obviously the site works with http:// but that's not what chrome defaults to any more.

And although it may not matter today, but some newer browser functionality is only available with https; https://www.digicert.com/blog/https-onl ... n-browsers

It's probably worth getting https fully working with virtual hosts. Apache can handle this easily enough; you can specify the cert values in the vhost config.
eg

Code: Select all

<VirtualHost *:443>
  ServerName foo.bar
  SSLCertificateFile ...path_to_cert_for_foo.bar
  SSLCertificateKeyFile ...path_to_keyfile_for_foo.bar
  SSLCertificateChainFile ...path_to_intermediate_chain_for_CA
  ...
</VirtualHost>

Now the LetsEncrypt supports it, you can even configure Apache to handle ECDSA and RSA certs at the same time. I've documented how I did it here.

[lurkio]

I’ve noticed this problem, particularly with bbcmicro.co.uk which is somewhat hard to get to if you remember the domain name but don’t have a clickable link to hand because, as you say, your browser will probably default to https:// and fail to find the Complete BBC Micro Games Archive website.

I confess I don’t really understand the technicalities or how hard it would be to fix but I have to say I think it would be a huge benefit if it could possibly be done.

[leenew]

I have had this too!
I assumed it was my ancient computer playing up.
Who can fix it?

Lee

[flaxcottage]

Interesting. I use Opera and haven't noticed this as a problem.

[1024MAK]

I don’t have anything that runs Chrome. I will have to try using Firefox.

Although on Firefox, if I using a trusted site and not dealing with personal/private/financial information, I just click through ignoring all the warnings if it’s about it being mixed http/https or it’s a non https site.

Don’t do this for sites where you download PC applications or software though.

Mark

[lurkio]

on Firefox, if I using a trusted site and not dealing with personal/private/financial information, I just click through ignoring all the warnings if it’s about it being mixed http/https or it’s a non https site.

The problem is that if you’re trying to get to bbcmicro.co.uk and if your browser has stuck https:// on the front of the domain, then even after you click through all the warnings you’ll be taken to what looks like this page rather than the actual Complete BBC Micro Games Archive site.

[1024MAK]

The problem is that if you’re trying to get to bbcmicro.co.uk and if your browser has stuck https:// on the front of the domain, then even after you click through all the warnings you’ll be taken to what looks like this page rather than the actual Complete BBC Micro Games Archive site.

Yes, I understand. I was just (trying to) say that with some sites (typically when there is a problem with certification, e,g, it’s expired) and where the URL is otherwise correct, I click through.

Obviously in this case, that’s not helping due to the browser taking you to a URL you don’t want.

Mark

[KenLowe]

Hmmm. I'm running Chrome 96.0.4664.45 and it doesn't seem to be defaulting to https on my setup. If I just type bbcmicro.co.uk it still defaults to http and loads the page just fine with a Not Secure label next to it. If I prefix the URL with https:// then I get the certificate mismatch error. Perhaps I've previously accepted setting that allows an unsecure connections to bbcmicro.co.uk. The point that sweh makes about making bbcmicro.co.uk secure is still valid, though.

[1024MAK]

As I understand it, different Chrome versions treat unsecured sites differently, as they (Chrome) are gradually increasing the restrictions over time. But keep in mind this is me regurgitating information that I picked up from another forum. I have not checked it myself, as I don’t use Chrome on any of my systems.

Mark

[BeebMaster]

I get this a lot in Firefox, even when visiting official Government websites, which I always thought was a bit perverse. I have an add-on called HTTPS Everywhere, which I thought was a sensible precaution when I installed it a long time ago. With that enabled, for example, I get this:

but bizarrely, the URL then shows https: at the beginning when it does let me in. With HTTPS Everywhere off, I have to click advanced before I get the option to continue:

I don't use favourites or bookmarks, I always type the URL into the URL bar. I don't use saved passwords either.

[sweh]

Obviously in this case, that’s not helping due to the browser taking you to a URL you don’t want.

More accurately, the browser is taking you to the correct URL, but the server is returning the wrong content.

[lurkio]

The problem with the https prefix not redirecting to the correct URL for bbcmicro.co.uk seems to have been fixed.

Does anyone know how..?

https://bbcmicro.co.uk

[danielj]

The problem with the https prefix not redirecting to the correct URL for bbcmicro.co.uk seems to have been fixed.

Does anyone know how..?

https://bbcmicro.co.uk

Someone with server access has set up Let's Encrypt, but I'm not sure who. Wasn't me!

edit: guys at netnorth I believe.

d.

[lurkio]

Well, it all seems a bit mysterious, but I guess thanks are due to Netnorth for fixing this issue!