1

When visiting a WordPress blog using HTTPS Chrome gives me a warning that the domain on the certificate (*.wordpress.com) does not match the URL (someguysblog.com).

This seems to be a known issue. So is there any way to whitelist this URL in chrome? And should/could I just whitelist all urls with this type of wordpress domain certificate?

(In case it is important, the certificate is signed by Go Daddy G2, which appears in my list of trusted root authorities in chrome settings.)

0

You can create an exception in your browser like it isbdescribed here:

https://en.support.wordpress.com/https/

You just have to import their certificate and trust it.

wordpress.com does not support SSL certificates for mapped domains. This is well known. Normally you do not need https when visiting a public wordpress.com website. They generally use it for login to the backend.

Visitors can try to access the website with http instead of https or add the certificate to the browser and trust it.

https://en.forums.wordpress.com/topic/ssl-and-security-certificates?replies=1

| improve this answer | |
  • so it is safe to trust all sites in the wordpress domain with that certificate? – jiggunjer Dec 3 '15 at 6:40
  • 1
    Yes, they all use *.wordpress.com as hostname. Importing the *.wordpress.com certificate and trusting it should be fine. – Daniel Ruf Dec 3 '15 at 7:03
  • thanks, I also noticed the guide in that link for chrome is a bit outdated. You can't drag-n-drop the certificate to save it (need right click). After saving the certificate I can just go to chrome settings->ssl/tls->manage certificates and import it. – jiggunjer Dec 3 '15 at 8:05
  • Interesting, I wonder if we can actually trust all wordpress.com sites...They must have quite limited functionality if you're saying you can blindly trust all of them. – Arlix Dec 3 '15 at 11:12
  • Well it is an issue on the side of wordpress.com with their configuration: "SSL certificates need to be signed to a specific domain, and we can’t provide certificates for every mapped domain, so our certificate is signed for WordPress.com." It seems this is the only viable solution at the moment because the mapped domains on wordpress.com resolve to *.wordpress.com as host. They already use a SSL certificate for *.wordpress.com. For example GitHub has not this problem because they use CName and map the domains correctly. – Daniel Ruf Dec 3 '15 at 11:18
1

Do not do this!

Installing this certificate dramatically reduces the security of SSL for all sites (eg: your bank), not just the Wordpress sites.

If an attacker can redirect your request from a site you intend to access over SSL to any site hosted on Wordpress, your browser will not issue a warning once you have installed the certificate as described. Attacks such as DNS poisoning and MiTM are examples of attacks that would allow this redirection to occur.

Instead of trusting the certificate, you can manually approve the certificate on each access.

| improve this answer | |
  • This assumes wordpress doesn't check sites they host for malicious content. Isn't it in their interest to only give certificates to trusted hosts? – jiggunjer Dec 4 '15 at 3:43
  • How much can they check @jiggunjer? Are you willing to trust the entirety of your SSL connections to Wordpress's checking? We know that the browser providers don't to do this as if they trusted the cert they'd trust it out of the box. – Neil Smithline Dec 4 '15 at 3:50
  • I do often manually check what certificate I am using whenever I access a critical site like my bank. So if all of a sudden I see a *.wordpress.com cert I'll log the IP and close the browser. I just don't wan't to click through several warnings every time I visit a wordpress blog (theres a lot). – jiggunjer Dec 4 '15 at 3:56
  • @jiggunjer - it seems to me that checking the cert for every site you use is more work and much riskier than just manually approving the certs on Wordpress sites. What if you forget to check once when you access your bank? Seems risky to even partially disable SSL security checks to me. – Neil Smithline Dec 4 '15 at 3:58
  • Could I configure chrome to do an additional check, so when I visit a 'critical' site it warns me if the site is using a certificate from a whitelisted CDN? Then I could have the best of both worlds... like a yellow padlock extension or something :p – jiggunjer Dec 4 '15 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.