TL;DR: Bing doesn't support SSL on www.bing.com and has never publicized it as a supported feature. The submitter had to manually type https://www.bing.com into the address bar to generate this 'error'.
The fact that the https://www.bing.com redirects to the HTTP version should be enough to show that this a known, unsupported case on the primary domain. The behavior has been like that for years.
Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge security risk, and defeats the purpose of even having an SSL cert.
Companies! Make sure your certs are all in order! There's no reason to send a page to your users over HTTPS if they can't trust the certificate. Canonical has been a long-time offender of this, with many of their pages sporting a certificate signed to canonical.com but being served by ubuntu.com.
We were experiencing a similar issue with a third party analytics solution where their SSL cert all of the sudden started to be delivered by Akamai as opposed to the FQDN of the company, as it was before. I am curious if Akamai is at fault here?
I made a site that checked for SSL cert expirations and misconfigurations, but I couldn't acquire any customers. I still think there's a business there somewhere, although maybe it really only sells as part of another product.
Edit: If anyone wants a script to check their certificates, here you go: https://gist.github.com/bretwalker/5420652. You'll just need to add in some sort of notification logic, especially for expirations, since they need to happen before a problem arises.
Stackify created this exact thing after the last time this happened with MS Azure about 2 months ago. It's called certalert.me (http://certalert.me) and is a free service.
It's not a huge business, but it was almost trivial to setup with all the advanced monitoring & diagnostics that stackify typically does anyway.
The sad thing is that SCOM can monitor for pending certificate expiration and validity. If Microsoft dogfooded a little more, they might have seen this.
I usually put a check for "SSL certificate expires in less than 30 days" in the NMS. There is certainly a market for network monitoring as a service and this is a useful check to have in one.
Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.
I have noticed that Bing is actually getting better. However, I still prefer Google for most things. Google "assumes" what you are looking for, this can be good or bad depending on what you are searching. Bing on the other hand is like the early version of Google, literal search with minimum assumption. I am glad it is there as a fallback from Google. If the Google servers go down or if they pull some crap like ban Google search from windows phone, Bing is a decent alternative.
One thing I really appreciate from Bing is catching upto Google maps. Throughout the whole Google Maps and Windows phone fiasco, I din't miss GMaps a bit, between Nokia Maps[1] and Bing Maps [2], there isn't much I missing out from not using Google maps. Infact, I would to love Google to catch up to Nokia by offering offline maps.
Another mention is their Bing Flight [3] search, similar to kayak minus their cookie/OS price manipulations. It also comes with an awesome price prediction.
Overall, Bing has some great products but if they really want to compete with Google Search, they really need to improve their algo.
I think Google has like 90% market share in Europe, and most of the rest is taken by Yandex/Yahoo. Bing has a very tiny market share worldwide (like 2%-4%).
The problem is that whilst being 'close' to as good as Google is a real achievement, they miss by far enough that it actually matters to most people.
Sure they might be godo enough that if they are a default, lots of people won't worry about changing, but not being as good as Google means there isn't much impetus for Google users to switch.
Its so impressing how Bing manages to deliver search results as well curated as those from Google. But wait, I just remembered that is because of they rely on search results from Google. ;P
I understand Hulu and Netflix but I have a hard time understanding why Amazon wouldn't support SSL. It does put a heavier processing load on web servers but you would think that if someone wants to encrypt their shopping traffic Amazon would be open to accommodating that.
It is not, by any means, trivial to find out what products someone is looking to buy and could be the basis of a social engineering hack.
I wished if Youtube videos were allowed under https. Currently, it just redirects to an error. If it didn't, this will put an end to ISPs throttling the Youtube streaming.
I couldn't find something on google, so I decided to give it a try. Can't hurt. I wanted to find out if anyone has done a study on language confusion(the effect where Russians have a hard time getting good at Polish because they confuse Polish words with Russian ones). Still can't find it ;)
Looks like someone pushed the wrong SSL cert to production:
www.bing.com uses an invalid security certificate.
The certificate is only valid for the following names:
a248.e.akamai.net , *.akamaihd.net , *.akamaihd-staging.net
(Error code: ssl_error_bad_cert_domain)
Australian Ebay (https://www.ebay.com.au/) has had the same problem for months, although I appear to get no response for https://www.ebay.com, so I'm not sure what their policy is on SSL access to the homepage.
I expect that Microsoft will fix Bing much more quickly.
Wow. This has been going on for an hour now. It's such a simple fix, especially since one would assume that they already have a valid cert somewhere (or that Akamai does). Yet they've had an hour of SSL downtime.
Does anyone know if Bing has any SSL-only clients? Like do any of their toolbars or built-in search widgets in Windows use SSL by default?
I don't like or use Bing services but when you get as big and complex as Bing, nothing is easy, it's not like you can open your text editor, modify one line, commit and push.
There so many other variables to take into consideration, by hurrying to fix, you could face all sort of vulnerabilities / other issues.
I'm not saying this error is acceptable, I'm saying it's ridiculous to say it's and easy fix without actually knowing anything, it might or it might now.
I've gotten a certificate error for over a year with Bing on HTTPS. I always just assumed that they, somewhat surprisingly, just didn't support HTTPS yet.
Slightly off-topic: what's a good way to handle cases such as this where you have a wildcard certificate?
I'll be getting a wildcard certificate for a project and, never having used one before, I had assumed the certificate would be valid for an entire domain.
Assuming that to be the case, is having a wildcard certificate for *.example.com and a second certificate for example.com the solution? It'd be nice to have the entire domain covered by a wildcard certificate and not just all subdomains.
[+] [-] casca|13 years ago|reply
https://bing.com: subject=/CN=*.bing.com
https://www.bing.com: subject=/C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net
[+] [-] rhplus|13 years ago|reply
Bing does support SSL on ssl.bing.com and publishes various links on that sub-domain, such as https://ssl.bing.com/webmaster/home/mysites
The fact that the https://www.bing.com redirects to the HTTP version should be enough to show that this a known, unsupported case on the primary domain. The behavior has been like that for years.
[+] [-] mrspeaker|13 years ago|reply
[+] [-] freehunter|13 years ago|reply
Companies! Make sure your certs are all in order! There's no reason to send a page to your users over HTTPS if they can't trust the certificate. Canonical has been a long-time offender of this, with many of their pages sporting a certificate signed to canonical.com but being served by ubuntu.com.
[+] [-] ThisIsADogHello|13 years ago|reply
https://bing.com/
Subject: CN=* .bing.com
X509v3 Subject Alternative Name: DNS:ieonline.microsoft.com, DNS:* .bing.com, DNS:* .windowssearch.com
--
https://www.bing.com/
Subject: C=US, O=Akamai Technologies, Inc., CN=a248.e.akamai.net
X509v3 Subject Alternative Name: DNS:a248.e.akamai.net, DNS:* .akamaihd.net, DNS:* .akamaihd-staging.net
[+] [-] elliottcarlson|13 years ago|reply
[+] [-] nopal|13 years ago|reply
Edit: If anyone wants a script to check their certificates, here you go: https://gist.github.com/bretwalker/5420652. You'll just need to add in some sort of notification logic, especially for expirations, since they need to happen before a problem arises.
[+] [-] simonw|13 years ago|reply
[+] [-] bogrollben|13 years ago|reply
It's not a huge business, but it was almost trivial to setup with all the advanced monitoring & diagnostics that stackify typically does anyway.
[+] [-] mdmarra|13 years ago|reply
[+] [-] SoftwareMaven|13 years ago|reply
1. http://www.venafi.com/solutions/ssl-certificate-management/
[+] [-] sdfjkl|13 years ago|reply
[+] [-] dools|13 years ago|reply
http://www.whynopadlock.com/
[+] [-] aduitsis|13 years ago|reply
[+] [-] NelsonMinar|13 years ago|reply
[+] [-] nivla|13 years ago|reply
One thing I really appreciate from Bing is catching upto Google maps. Throughout the whole Google Maps and Windows phone fiasco, I din't miss GMaps a bit, between Nokia Maps[1] and Bing Maps [2], there isn't much I missing out from not using Google maps. Infact, I would to love Google to catch up to Nokia by offering offline maps.
Another mention is their Bing Flight [3] search, similar to kayak minus their cookie/OS price manipulations. It also comes with an awesome price prediction.
Overall, Bing has some great products but if they really want to compete with Google Search, they really need to improve their algo.
[1] http://here.com [2] http://maps.bing.com [3] http://flights.bing.com
[+] [-] mtgx|13 years ago|reply
[+] [-] lelandbatey|13 years ago|reply
[+] [-] TomAnthony|13 years ago|reply
Sure they might be godo enough that if they are a default, lots of people won't worry about changing, but not being as good as Google means there isn't much impetus for Google users to switch.
[+] [-] sixothree|13 years ago|reply
[+] [-] wallunit|13 years ago|reply
http://googleblog.blogspot.de/2011/02/microsofts-bing-uses-g...
[+] [-] olegbl|13 years ago|reply
[+] [-] ljd|13 years ago|reply
It is not, by any means, trivial to find out what products someone is looking to buy and could be the basis of a social engineering hack.
[+] [-] nivla|13 years ago|reply
[+] [-] aaronsnoswell|13 years ago|reply
[+] [-] smackfu|13 years ago|reply
[+] [-] timthelion|13 years ago|reply
[+] [-] dsfasfasf|13 years ago|reply
[+] [-] heymishy|13 years ago|reply
[+] [-] Ricapar|13 years ago|reply
[+] [-] dominicgs|13 years ago|reply
I expect that Microsoft will fix Bing much more quickly.
[+] [-] timthelion|13 years ago|reply
[+] [-] deepblueocean|13 years ago|reply
Does anyone know if Bing has any SSL-only clients? Like do any of their toolbars or built-in search widgets in Windows use SSL by default?
[+] [-] Trufa|13 years ago|reply
I don't like or use Bing services but when you get as big and complex as Bing, nothing is easy, it's not like you can open your text editor, modify one line, commit and push.
There so many other variables to take into consideration, by hurrying to fix, you could face all sort of vulnerabilities / other issues.
I'm not saying this error is acceptable, I'm saying it's ridiculous to say it's and easy fix without actually knowing anything, it might or it might now.
[+] [-] xonea|13 years ago|reply
[+] [-] bcoates|13 years ago|reply
[+] [-] ricardobeat|13 years ago|reply
[+] [-] icecreamguy|13 years ago|reply
[+] [-] webignition|13 years ago|reply
I'll be getting a wildcard certificate for a project and, never having used one before, I had assumed the certificate would be valid for an entire domain.
I understand from this situation that a wildcard certificate is relevant only to https://*.example.com and not the subdomainless https://example.com.
Assuming that to be the case, is having a wildcard certificate for *.example.com and a second certificate for example.com the solution? It'd be nice to have the entire domain covered by a wildcard certificate and not just all subdomains.
[+] [-] LTheobald|13 years ago|reply
[+] [-] pasbesoin|13 years ago|reply
(Actions speak louder than words.)
[+] [-] smackfu|13 years ago|reply
[+] [-] taylorbuley|13 years ago|reply
[+] [-] SG-|13 years ago|reply
[+] [-] unknown|13 years ago|reply
[deleted]
[+] [-] kylesethgray|13 years ago|reply
[+] [-] zoowar|13 years ago|reply
[+] [-] mekoka|13 years ago|reply
[+] [-] l0c0b0x|13 years ago|reply
Most-likely an oversight, but it does suggest ssl isn't supported.
[+] [-] tosseraccount|13 years ago|reply
25000 more employees can't fix this kind of incompetence.