SSL Certificate expired on [cdn-business2.discourse.org]

support
1

Just an FYI, my antivirus is reporting that the SSL certificate on cdn-business2.discourse.org has expired. Looking at the certificate info, it looks like it expired on 9/15/2017.

image
image.png405Ɨ510 9.72 KB

2 Likes
2

That CDN should no longer be in use. What site are you seeing this on?

1 Like
3

wanikani.com, and email notifications from the same.
Should I let them know directly? I know Discourse hosts them.

4

We do host them so thatā€™s on us. Will look into this.

1 Like
5

Iā€™m trying to figure out what file is coming from there, but if I select ā€˜blockā€™ in my anti-virus, I still donā€™t see any failed files in Chromeā€™s dev tools, so Iā€™m not sure. But I can trigger it every time I refresh the page, soā€¦ itā€™s in there somewhere.

1 Like
6

Iā€™ve narrowed down some of the links.

In my email messages, itā€™s due to emojis in archived (i.e. old) mail. So that makes perfect sense. No problem there.

If I go to community.wanikani.com and refresh the page, I donā€™t get any warnings. But if I open the developer console (Chrome), I immediately get the warning, and will also get it every time I refresh the page with developer console still open.

Itā€™s worth noting that I have ā€œDisable Cacheā€ checked in the developer console, so itā€™s reloading everything every time, whereas with the console closed, it will use cache. That may explain the difference.

Iā€™ve checked under Firefox, and get similar behavior.

IE doesnā€™t have any problems.

3 Likes
10

Iā€™ve looked at this and canā€™t find any references to the old CDN (cdn-business2) on the live site. Also, I donā€™t get any warnings with the developer console open.

Are there any specific pages with which youā€™re having trouble? With that information Iā€™ll be able to address the problem.

3 Likes
11

The home page of community.wanikani.com was doing it, as well as most others I tried.
I couldnā€™t find any references to cdn-business2 either, though the security popup must be finding it somewhere.

Unfortunately, yesterday I told my antivirus to accept the SSL certificate, and I canā€™t find where to revoke it now, so Iā€™m not sure I can replicate the issue anymore :frowning:

But we have a large population of fellow software people on the site for some reason, so I can ask if anyone else is seeing this, and point them to this thread.

Thanks for looking into it!

13

One of the members at wanikani was able to find a reference to cdn-business2.discourse.org.
His initial comment about .org vs .com is due to my mistyping when I posted an inquiry on wanikani.com.

3 Likes
14

I think my suspicions are right. I tested with a basic html file like this:

<!DOCTYPE html>
<html>
<head>
	<script>
		//# sourceMappingURL=https://cdn-business2.discourse.org/assets/plugin-8bb7a7a3d6d016496acaa8df06bd691326dfec1aaf169e60160556d9794ddfbc.js.map
	</script>
</head>
<body>
	<h1>Cabecera</h1>
	<p>PƔrrafo.</p>
</body>
</html>

If I open this with Firefox (with the dev console open) it makes the request to cdn-business2.discourse.org and the AV complains.

5 Likes
15

Oh yes, excellent sleuthing work all!

1 Like