Conversation
The server sends a different, non-EV, certificate if you go to https://fastmail.com rather than https://www.fastmail.com, even though you get redirected to www the non-EV certificate persists.
There was a problem hiding this comment.
I'd prefer not to redirect between domains when the only difference is an EV cert vs a non-EV cert. So long as fastmail.com (sans www) answers HTTPS correctly, I think serving the EV cert on that domain is up to the site operator.
I do appreciate the test url additions, though! If you'd like to submit this ruleset as a straight rewrite without changing domain names.
Also, looking at the ruleset more closely it looks like the existing rule rewrites fastmail.fm to fastmail.com unnecessarily: fastmail.fm answers HTTPS correctly.
It's not really a conscious decision. More a corner-case in the server configuration that HTTPS Everywhere exposes. http://fastmail.com does a 301 redirect to https://www.fastmail.com https://fastmail.com also does a 301 redirect to https://www.fastmail.com The problem is when you hit https://fastmail.com first, it negotiates a TLS connection and gets a cert for *.fastmail.com instead of the EV-cert for www.fastmail.com and then because the two hosts share the same IP the browser doesn't renegotiate the TLS connection when it redirects and keeps the non-EV wildcard cert it already has. Essentially it still says "www.fastmail.com" in the address bar but because you came in through https://fastmail.com you have a different cert than if you had gone directly to https://www... The thing is most people will never encounter this (without HTTPS Everywhere) because no one types "https://fastmail.com" in the address bar. They type "fastmail.com", which hits the http:// site first and get immediately redirected to https://www and therefore get the EV cert. The problem is HTTPS Everywhere makes typing "fastmail.com" equivalent to typing "https://fastmail.com" |
|
You make a good point that this is something we trigger rather than the provider triggering. Given that, and the fact that this is a no-www -> www rewrite, I'm okay with this. |
Fix Fastmail sending the wrong certificate
The server sends a different, non-EV, certificate if you go to https://fastmail.com rather than https://www.fastmail.com, even though you get redirected to www the non-EV certificate persists.
I let Fastmail know about this a few months ago but they haven't fixed it.