13 ms·

I'm getting certificate errors -- is this part of the point or something else?

by Qz 15y ago

maqr 15y ago
Not part of the point, try the http version: http://www.reddit.com/r/SOPA/comments/nhfes/do_you_guys_realize_this_might_mean_reddit_might/c395f00 http://www.reddit.com/r/SOPA/comments/nhfes/do_you_guys_real...
deleted 15y ago
[deleted]
redthrowaway 15y ago
Chrome told me I was being redirected to Akamai, so I'm guessing it's just a configuration issue. "Proceeding anyway" takes you to the right place.
notatoad 15y ago
it's because OP linked to the HTTPS version of reddit, which doesn't exist. akamai will serve an HTTPS version of any page that they cache, and if the customer has not configured HTTPS they will serve it up with their certificate. reddit uses akamai for page content but not for any authentication, there are no security benefits to using https://reddit https://reddit instead of http://reddit http://reddit
- tobias3 15y ago
  You are avoiding eavesdropping attacks but not man-in-the-middle attacks. That did not stop me from removing the 's' instead of clicking three times in Firefox.
- mike-cardwell 15y ago
  FWIW, a HTTPS version of Reddit does exist. It just happens to be on the pay.reddit.com hostname instead. See: https://pay.reddit.com/r/SOPA/comments/nhfes/do_you_guys_realize_this_might_mean_reddit_might/c395f00 https://pay.reddit.com/r/SOPA/comments/nhfes/do_you_guys_rea...
  - notatoad 15y ago
    there was an explanation from one of the admins once upon a time about why pay.reddit wasn't any more secure than standard reddit. i forget the details, but the consensus was don't bother.
    - mike-cardwell 15y ago
      I'll stick with the side of caution and use the freely available HTTPS version until someone proves the above claim.
troels 15y ago
Had me baffled too. Explanation here: http://revealingerrors.com/akamai_ssl http://revealingerrors.com/akamai_ssl Scary stuff - I never heard of this Akamai entity before.
soitgoes 15y ago
Nothing in the SSL certificate returned identifies www.reddit.com hence the warning. The common name of the cert (typically used to identify the website) is actually a248.e.akamai.net. I think akamai are a service that many websites use but their generic SSL cert can cause problems. You can view the cert using: http://certlogik.com/sslchecker/www.reddit.com/ http://certlogik.com/sslchecker/www.reddit.com/

I'm getting certificate errors -- is this part of the point or something else?

by Qz 15y ago

I'm getting certificate errors -- is this part of the point or something else?

maqr 15y ago

Not part of the point, try the http version: http://www.reddit.com/r/SOPA/comments/nhfes/do_you_guys_realize_this_might_mean_reddit_might/c395f00 http://www.reddit.com/r/SOPA/comments/nhfes/do_you_guys_real...

deleted 15y ago

[deleted]

redthrowaway 15y ago

Chrome told me I was being redirected to Akamai, so I'm guessing it's just a configuration issue. "Proceeding anyway" takes you to the right place.

notatoad 15y ago

it's because OP linked to the HTTPS version of reddit, which doesn't exist. akamai will serve an HTTPS version of any page that they cache, and if the customer has not configured HTTPS they will serve it up with their certificate. reddit uses akamai for page content but not for any authentication, there are no security benefits to using https://reddit https://reddit instead of http://reddit http://reddit

tobias3 15y ago
You are avoiding eavesdropping attacks but not man-in-the-middle attacks. That did not stop me from removing the 's' instead of clicking three times in Firefox.
mike-cardwell 15y ago
FWIW, a HTTPS version of Reddit does exist. It just happens to be on the pay.reddit.com hostname instead. See: https://pay.reddit.com/r/SOPA/comments/nhfes/do_you_guys_realize_this_might_mean_reddit_might/c395f00 https://pay.reddit.com/r/SOPA/comments/nhfes/do_you_guys_rea...
- notatoad 15y ago
  there was an explanation from one of the admins once upon a time about why pay.reddit wasn't any more secure than standard reddit. i forget the details, but the consensus was don't bother.
  - mike-cardwell 15y ago
    I'll stick with the side of caution and use the freely available HTTPS version until someone proves the above claim.

troels 15y ago

Had me baffled too. Explanation here: http://revealingerrors.com/akamai_ssl http://revealingerrors.com/akamai_ssl Scary stuff - I never heard of this Akamai entity before.

soitgoes 15y ago

Nothing in the SSL certificate returned identifies www.reddit.com hence the warning. The common name of the cert (typically used to identify the website) is actually a248.e.akamai.net. I think akamai are a service that many websites use but their generic SSL cert can cause problems. You can view the cert using: http://certlogik.com/sslchecker/www.reddit.com/ http://certlogik.com/sslchecker/www.reddit.com/