Bing doesn't support SSL

https://bing.com/

by rljy • 13 years ago

287 158 13 years ago

bing.com

casca• 13 years ago

TL;DR: bing SSL certificate is wrong.

https://bing.com: subject=/CN=*.bing.com

https://www.bing.com: subject=/C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net

ThisIsADogHello• 13 years ago

Don't forget the X09v3 alternate subject names.

https://bing.com/

Subject: CN=* .bing.com

X509v3 Subject Alternative Name: DNS:ieonline.microsoft.com, DNS:* .bing.com, DNS:* .windowssearch.com

https://www.bing.com/

Subject: C=US, O=Akamai Technologies, Inc., CN=a248.e.akamai.net

X509v3 Subject Alternative Name: DNS:a248.e.akamai.net, DNS:* .akamaihd.net, DNS:* .akamaihd-staging.net

mrspeaker• 13 years ago

Wow, that's the first time I've ever seen a 0-word article get the TL;DR treatment.

return0• 13 years ago

Actually the warning message from chrome is pretty lengthy

hasenj3• 13 years ago

TL;DR means "here's a very short explanation".

elliottcarlson2• 13 years ago

We were experiencing a similar issue with a third party analytics solution where their SSL cert all of the sudden started to be delivered by Akamai as opposed to the FQDN of the company, as it was before. I am curious if Akamai is at fault here?

johngunderman• 13 years ago

Was this in the past week? Because just a few days ago I was experiencing a similar problem. I attempted to access https://rememberthemilk.com and chrome complained about the SSL cert, as I was receiving the cert for their CDN and not for rememberthemilk itself. I couldn't find anyone that could reproduce the issue, but it occurred consistently on my computer regardless of browser. It resolved itself 20 min after I first noticed it, but I'm still really curious as to why it happened in the first place.

brokentone• 13 years ago

This is Akamai kinda trying to serve HTTPS on domains that don't have HTTPS setup. I'm not sure why they attempt it at all, but it's not really their fault. Same thing on my domain: https://www.theblaze.com/

freehunter5• 13 years ago

Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge security risk, and defeats the purpose of even having an SSL cert.

Companies! Make sure your certs are all in order! There's no reason to send a page to your users over HTTPS if they can't trust the certificate. Canonical has been a long-time offender of this, with many of their pages sporting a certificate signed to canonical.com but being served by ubuntu.com.

T-hawk• 13 years ago

> There's no reason to send a page to your users over HTTPS if they can't trust the certificate.

There can be. HTTPS still gives you encryption over the wire. It still protects against a passive eavesdropper, like a casual packet sniffer on a public wi-fi network. The whole certificate deal protects against a Mallory with power to intercept and spoof messages. Of course nobody on the public internet can be sure there isn't a Mallory in or at the edge of the user's ISP, but in plenty of intranet or otherwise controlled networking scenarios, HTTPS with certificates lacking a trust chain can be reasonable.

rhplus• 13 years ago

TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com into the address bar to generate this 'error'.

Bing does support SSL on ssl.bing.com and publishes various links on that sub-domain, such as https://ssl.bing.com/webmaster/home/mysites

The fact that the https://www.bing.com redirects to the HTTP version should be enough to show that this a known, unsupported case on the primary domain. The behavior has been like that for years.

TazeTSchnitzel• 13 years ago

>TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com into the address bar to generate this 'error'.

Or use HTTPS Everywhere. Personally, I'd also like it if in future, web browsers would try HTTPS first and HTTP second.

dhruvbird• 13 years ago

Why don't they just support the thing that is most reasonably expected and not surprise n00bs like me.

cpeterso2• 13 years ago

The bing.com certificate says it is valid for the following names: ieonline.microsoft.com , .bing.com , .windowssearch.com. So why does https://www.bing.com not match *.bing.com?

Ricapar• 13 years ago

Looks like someone pushed the wrong SSL cert to production:

  www.bing.com uses an invalid security certificate.
  
  The certificate is only valid for the following names:
    a248.e.akamai.net , *.akamaihd.net , *.akamaihd-staging.net  

  (Error code: ssl_error_bad_cert_domain)

timthelion7• 13 years ago

http://revealingerrors.com/akamai_ssl

bshastry• 13 years ago

The post does not explain why Akamai's cert is being used. If bing over SSL were working correctly in the past---which I believe to be true---and given that Bing were using Akamai in the past, why the problem now?

dominicgs• 13 years ago

Australian Ebay (https://www.ebay.com.au/) has had the same problem for months, although I appear to get no response for https://www.ebay.com, so I'm not sure what their policy is on SSL access to the homepage.

I expect that Microsoft will fix Bing much more quickly.

ry0ohki• 13 years ago

Mandrill has also had this problem for months (I notified them, but still broken) https://www.mandrill.com/

robglas• 13 years ago

Passed this on to relevant team to look into for you (I'm with PayPal myself, so not sure about eBay's SSL approach).

couchmonster• 13 years ago

It's been this way since 2009... http://revealingerrors.com/akamai_ssl

nopal5• 13 years ago

I made a site that checked for SSL cert expirations and misconfigurations, but I couldn't acquire any customers. I still think there's a business there somewhere, although maybe it really only sells as part of another product.

Edit: If anyone wants a script to check their certificates, here you go: https://gist.github.com/bretwalker/5420652. You'll just need to add in some sort of notification logic, especially for expirations, since they need to happen before a problem arises.

simonw• 13 years ago

Sounds like something you could license to companies to use as a lead generation tool - like HubSpot's Marketing Grader http://marketing.grader.com/

nopal5• 13 years ago

That's a very interesting idea, Simon, and one that didn't even cross my mind.

I've since moved on to a new project. If anyone wants to talk about taking over the site, shoot me a message at bretwalker /at/ Google's email. It's Django and has some branding and a domain: http://static.nyquistrate.com.s3.amazonaws.com/media/certcia...

mdmarra3• 13 years ago

The sad thing is that SCOM can monitor for pending certificate expiration and validity. If Microsoft dogfooded a little more, they might have seen this.

aduitsis• 13 years ago

Which protocols do you support besides https? imap or pop with tls perhaps?

nopal5• 13 years ago

Yes, IMAP and POP were supported: https://gist.github.com/bretwalker/5420652

bogrollben• 13 years ago

Stackify created this exact thing after the last time this happened with MS Azure about 2 months ago. It's called certalert.me (http://certalert.me) and is a free service.

It's not a huge business, but it was almost trivial to setup with all the advanced monitoring & diagnostics that stackify typically does anyway.

nopal5• 13 years ago

Very useful. It's not a super hard problem to solve, but I did think it provided enough value that companies would be willing to pay for it. SSL is used on the most important pieces of a business' infrastructure, I thought it'd be a simple sell.

I also can't tell if certalert.me checks for hostname mismatches. That was another part of my service, because a misconfiguration is just as fatal as an expired certificate.

dools• 13 years ago

I love this one:

http://www.whynopadlock.com/

SoftwareMaven• 13 years ago

Venafi[1] has made a pretty good business out of cert management.

1. http://www.venafi.com/solutions/ssl-certificate-management/

sdfjkl2• 13 years ago

I usually put a check for "SSL certificate expires in less than 30 days" in the NMS. There is certainly a market for network monitoring as a service and this is a useful check to have in one.

pringles• 13 years ago

Here's a free service that makes auto-updating iCal calendars from SSL and domain expirations: http://domainical.org/

aaronsnoswell• 13 years ago

The real question is, why were you on bing? :P

heymishy• 13 years ago

comment of the day!

ganarajpr• 13 years ago

To Microsoft : Please fix your IE debacle ( somehow!!).. Its affecting your other products.. Its reputation is becoming infectious.

timthelion7• 13 years ago

I couldn't find something on google, so I decided to give it a try. Can't hurt. I wanted to find out if anyone has done a study on language confusion(the effect where Russians have a hard time getting good at Polish because they confuse Polish words with Russian ones). Still can't find it ;)

mcherm• 13 years ago

Try asking on http://www.reddit.com/r/linguistics/ -- those guys are pretty sharp about this kind of thing. (Assuming that reddit isn't down due to DOS attack.)

tszyn• 13 years ago

Try googling / binging "L1 interference".

zalew2• 13 years ago

I know about funny word differences, but we have no problems learning russian, why russians would have problems learning polish?

this is my favorite http://translate.google.com/#ru/pl/%D0%BA%D0%BE%D0%B2%D0%B5%... (in polish it sounds like 'caviar in a can')

dsfasfasf• 13 years ago

Don't want google to know everything that I'm doing. Especially when searching for porn.

wereHamster• 13 years ago

You can use chrome's incognito mode.

smackfu2• 13 years ago

Bing's birds-eye view maps are great. Google is trying to add the same isometric views but their coverage isn't nearly as good.

taylorbuley2• 13 years ago

This is the second major flub this year. Azure's cert expired in prod not many weeks ago.

timthelion7• 13 years ago

Actually, it's been like this a really long time. I just noticed, that HN stories which have nondescript titles fare better, so I decided to conduct a little experiment. 1st spot on the front page seems to confirm my hypothesis.

huhtenberg• 13 years ago

Was it you who changed the submission title or was it some mod acting up yet again? The original was interesting and it wasn't factually inaccurate.

xonea3• 13 years ago

Well, it is not really a flub of this year. Or even something specific to Bing (try https://www.nba.com/ or https://www.jetstar.com/)

Basically Akamai is using the same ssl certifate on (most?) of its edge servers. The reason for that is that traditionally it is difficult to decide for a server that is serving multiple domains, which SSL certificate to show for a client -- the HTTP header, which contains the hostname is sent way after the certificate information has been exchanged.

A certificate can contain several hostnames (in the SubjectAlternativeName extension) - but that does not scale if you have a big number of sites for a number of reasons (re-signing the certificate all the time is a nuisance, browser behavior with certificates containing several thousand hostnames is kind of fun, etc.).

Nowadays there are solutions to that problem (using the Server Name Indication TLS extension -- which basically sends the desired hostname in the TLS exchange before the certificate is exchanged). However, the number of sites actively using SNI is very low - google is the only site known to me that is doing it (try accessing google.com with/without SNI and you will get completely different certificates).

The reason why SNI is not yet that much used is that client support is still a bit flaky. Afaik it is supported by all recent desktop browsers. However, I think the XP TLS stack does not support it (and there are still enough users on that), android only supports it starting with version 3.0, etc.

So - at the moment you basically still need a separate IP for each site (or at least one IP for sites that can share one certificate).

I don't know if akamai also supports custom SSL certificates. Facebook seems to use kind of an interesting mix between akamai and self-hosting - facebook.com itself seems to be hosted by facebook. However, if you use facebook over ssl and check the url of served profile pictures, you will see that they go to https://fbcdn-profile-a.akamaihd.net (or similar) -- hence to one of the hostnames that is mentioned in the akamai edge certificates.

taylorbuley2• 13 years ago

Akamai definitely supports custom SSL certs. You provide them a chain cert and they pass it on your behalf.

To me, this looks like they pushed the wrong cert to prod.

QA_Confidential• 13 years ago

Akamai isn't using the same certificate on its edge servers, unless you mean the same customer certificate being replicated (in which case you are correct). Basically, Akamai maps each ssl certificate to a slot on the cache server, which is assigned to a map similar to the standard edge CDN. Each edge machine thinks itself the site. Each time a new certificate is issued by an Akamai partner CA or the customer's CA of choice, it is pushed out by Akamai to the ssl edge network.

SAN certs are an entirely different ball of wax. Akamai does support them, but there are some challenges getting them deployed.

Unfortunately, the deployment for any type of certificate with Akamai is a very manual process.

Y0L0• 13 years ago

I sincerely hope that this not some sick and twisted joke by Microsoft.

theycallmemorty• 13 years ago

I think you're in the clear.

deepblueocean• 13 years ago

Wow. This has been going on for an hour now. It's such a simple fix, especially since one would assume that they already have a valid cert somewhere (or that Akamai does). Yet they've had an hour of SSL downtime.

Does anyone know if Bing has any SSL-only clients? Like do any of their toolbars or built-in search widgets in Windows use SSL by default?

xonea3• 13 years ago

This is not new and probably will not be fixed fast - the situation has been like that (unchanged) since at least 2011.

Trufa• 13 years ago

Easy fix? What the hell?

I don't like or use Bing services but when you get as big and complex as Bing, nothing is easy, it's not like you can open your text editor, modify one line, commit and push.

There so many other variables to take into consideration, by hurrying to fix, you could face all sort of vulnerabilities / other issues.

I'm not saying this error is acceptable, I'm saying it's ridiculous to say it's and easy fix without actually knowing anything, it might or it might now.

timthelion7• 13 years ago

See https://news.ycombinator.com/item?id=5576342

bcoates• 13 years ago

I think it's always been like this. Bing has never run over https as far as I can tell.

ricardobeat2• 13 years ago

According to MS guys this is not an error, SSL is supported at https://ssl.bing.com/ which is what their tools use.

smackfu2• 13 years ago

Bing is normally not served over https, so this probably only affects a tiny percentage of the users, even though it looks bad here.

tosseraccount• 13 years ago

Short Microsoft.

25000 more employees can't fix this kind of incompetence.

ccarter842• 13 years ago

There's gotta be some kind of organizational size:responsiveness inverse metric for stuff like this

bwooceli• 13 years ago

back up as of 8:42 CST

joshstrange• 13 years ago

I'm still seeing it 9:50 EST

a_1• 13 years ago

why would you use bing?

LTheobald• 13 years ago

It's not just Bing. I'm always accidentally going to http://stackoverflow.com & getting an error.

benparsons• 13 years ago

I don't understand - that's never resulted in an error for me.

_ea1k• 13 years ago

Maybe he meant https://stackoverflow.com/ ?

rschmitty• 13 years ago

Shh, only MS bashing can go on in this thread

jonknee• 13 years ago

SO uses a MS stack so it's not too far off...

pasbesoin• 13 years ago

Why should we take Microsoft's Internet efforts seriously when they continue, perpetually, not to do so, themselves?

(Actions speak louder than words.)

mekoka• 13 years ago

The real question is, is bing.com even supposed to be served over https?

city41• 13 years ago

why wouldn't you want to serve it over SSL?

sdfjkl2• 13 years ago

With very few exceptions, everything is supposed to be served over HTTPS (or other secure protocols). Certainly something as sensitive as search traffic. Tell me your search queries and I'll tell you your interests, health problems, relationships, if you're happy in your job and what kind of porn you like.

ccarter842• 13 years ago

That last one is where they get ya

icecreamguy• 13 years ago

I've gotten a certificate error for over a year with Bing on HTTPS. I always just assumed that they, somewhat surprisingly, just didn't support HTTPS yet.

webignition• 13 years ago

Slightly off-topic: what's a good way to handle cases such as this where you have a wildcard certificate?

I'll be getting a wildcard certificate for a project and, never having used one before, I had assumed the certificate would be valid for an entire domain.

I understand from this situation that a wildcard certificate is relevant only to https://*.example.com and not the subdomainless https://example.com.

Assuming that to be the case, is having a wildcard certificate for *.example.com and a second certificate for example.com the solution? It'd be nice to have the entire domain covered by a wildcard certificate and not just all subdomains.

phlo• 13 years ago

Not all that off-topic. For your example, you should get a certificate made out to ("Subject CN") example.com or * .example.com, then list both the wildcard and the subdomainless entry as Subject Alternative Names.

Bing is doing something similar (see https://news.ycombinator.com/item?id=5576271), but they appear to have forgotten to list the plain domain.

klapinat0r• 13 years ago

Typically a certificate issuer will grant you both when you buy a wildcard one.

This can be achieved via SAN (alternative names): http://en.wikipedia.org/wiki/Wildcard_certificate#Limitation

vsync2• 13 years ago

Comodo's been good to me in this regard.

Incidentally, beware of RapidSSL and their "free www." SAN; they only grant it in certain specific and undocumented circumstances.

jimbobimbo• 13 years ago

Depends on the type of cert. There're EV SSL certificates that do not allow wildcards, for example.

mergy• 13 years ago

The extra cert dialogue box will really drive up traffic. #not

NelsonMinar2• 13 years ago

Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.

wallunit• 13 years ago

Its so impressing how Bing manages to deliver search results as well curated as those from Google. But wait, I just remembered that is because of they rely on search results from Google. ;P

http://googleblog.blogspot.de/2011/02/microsofts-bing-uses-g...

NelsonMinar2• 13 years ago

If you want to learn more about that event than just a ":P", Danny Sullivan's analysis at the time was excellent: http://searchengineland.com/bing-why-googles-wrong-in-its-ac...

sixothree2• 13 years ago

I think it's as simple as having chosen an awful name. Bing is physically difficult to pronounce and it evokes no meaning whatsoever.

TallGuyShort• 13 years ago

Do you really the pronunciation difficulty and lack of meaning is so significantly different than "Google" was when it launched? It's more vocalized, yes, but only a single syllable for Google's two, and relatively noone actually think of "googolplex" when talking about Google. The sound "bing", I think, conveys speediness, which they took advantage of with the slogan "Bing and decide". It's a quick, sharp sound - as should be your searches.

TomAnthony• 13 years ago

The problem is that whilst being 'close' to as good as Google is a real achievement, they miss by far enough that it actually matters to most people.

Sure they might be godo enough that if they are a default, lots of people won't worry about changing, but not being as good as Google means there isn't much impetus for Google users to switch.

psbp2• 13 years ago

Yep, they don't offer any huge incentive to switch. Google has a much more robust search and as an android user I actually like the integration into Now.

mtgx• 13 years ago

I think Google has like 90% market share in Europe, and most of the rest is taken by Yandex/Yahoo. Bing has a very tiny market share worldwide (like 2%-4%).

lelandbatey• 13 years ago

I didn't know that DuckDuckGo and Yahoo pass their queries onto Bing. Does anyone else have any information on that, it sounds really interesting.

nivla3• 13 years ago

If I recall correctly, DDG used to solely depend on Bing's Search API but now they use various sources including their own to compile the search result.

nivla3• 13 years ago

I have noticed that Bing is actually getting better. However, I still prefer Google for most things. Google "assumes" what you are looking for, this can be good or bad depending on what you are searching. Bing on the other hand is like the early version of Google, literal search with minimum assumption. I am glad it is there as a fallback from Google. If the Google servers go down or if they pull some crap like ban Google search from windows phone, Bing is a decent alternative.

One thing I really appreciate from Bing is catching upto Google maps. Throughout the whole Google Maps and Windows phone fiasco, I din't miss GMaps a bit, between Nokia Maps[1] and Bing Maps [2], there isn't much I missing out from not using Google maps. Infact, I would to love Google to catch up to Nokia by offering offline maps.

Another mention is their Bing Flight [3] search, similar to kayak minus their cookie/OS price manipulations. It also comes with an awesome price prediction.

Overall, Bing has some great products but if they really want to compete with Google Search, they really need to improve their algo.

[1] http://here.com [2] http://maps.bing.com [3] http://flights.bing.com

Osiris• 13 years ago

This is pretty embarrassing after their Azure SSL certification expirations issues just a month or so ago.

johnchristopher• 13 years ago

For what it's worth I alawys had problems reaching bing.com when using openDNS.

kylesethgray• 13 years ago

Looks like it might be related to the reddit DDOS: http://www.reddit.com/r/redditTraffic/comments/1coaer/201304...

SG-3• 13 years ago

No.

wutbrodo• 13 years ago

How?

rileytg• 13 years ago

HA!

SG-3• 13 years ago

bing.com doesn't do SSL, never did except at ssl.bing.com (which doesn't actually do SSL anymore).

zoowar2• 13 years ago

Google should start a "don't get Bingle Berried" campaign like Microsoft's Scroogled.

psbp2• 13 years ago

Don't get Fucked in the ass by Microsoft

Reply

zoowar2• 13 years ago

No, not that. This => http://www.urbandictionary.com/define.php?term=dingle+berry

Reply

olegbl• 13 years ago

Neither does Hulu. https://hulu.com/ Amazon redirects to HTTP: https://www.amazon.com/ Netflix redirects to HTTP: https://netflix.com/ Etc... Etc... Etc... Why pick on Bing?

Reply

ljd• 13 years ago

I understand Hulu and Netflix but I have a hard time understanding why Amazon wouldn't support SSL. It does put a heavier processing load on web servers but you would think that if someone wants to encrypt their shopping traffic Amazon would be open to accommodating that.

It is not, by any means, trivial to find out what products someone is looking to buy and could be the basis of a social engineering hack.

Reply

nivla3• 13 years ago

I wished if Youtube videos were allowed under https. Currently, it just redirects to an error. If it didn't, this will put an end to ISPs throttling the Youtube streaming.

Reply

l0c0b0x• 13 years ago

This just means that there is no redirect on www.bing.com via SSL. Bing.com (ssl) has a proper re-direct to non-ssl www.bing.com.

Bing doesn't support SSL

Related Stories