Skip to main content

SSL and the "www" alias of "blogspot.com"

Last month, we observed that SSL, though generally available for blogs published to "blogspot.com", did not work for all such blogs.

Owners of blogs who used the "www" alias of "blogspot.com", such as my BlogSpot mirror blog "https://blogger-status-for-real.blogspot.com/", reported annoying error messages, when trying to access the "www" alias of the blog, using SSL.
Your connection is not private

For my BlogSpot mirror blog, you'll see the problem, when viewing "https://www.blogger-status-for-real.blogspot.com/". The problem apparently involves the SSL certificate for "blogspot.com", which does not include the "www" aliase for the subdomains (such as "blogger-status-for-real.blogspot.com").

This month, Blogger decided to drop support for the "www" alias of "blogspot.com", when using SSL.

This means that you can have either SSL for your "blogspot.com" published blog - or you can let your blog be referenced using the "www" alias - but you cannot have both. "https://www.blogger-status-for-real.blogspot.com/" will simply not be available.


Nobody can access my test blog - without some scary decisions - and extra work.


A blog with an invalid certificate, when SSL access is attempted, can be accessed - but not using SSL. The browser, that the reader is using, will not connect to a website with an invalid certificate, using SSL.


The link to the blog is there - if you look for it. How many would be readers will willingly connect to the unsafe non SSL connection?


If the blog uses HSTS, instead of HTTPS, a connection will not be available, period.


This is my mirror blog. It, too, is not accessible using SSL.



My mirror blog, however, uses HSTS - and HSTS does not offer an insecure access option. Blogs which use HSTS won't be accessible, period, insecurely.


If you're going to offer SSL access to your blog, your readers won't be happy, using the "www" alias - if the alias works, at all. You'll need to use the base BlogSpot URL - instead of the "www" alias of the BlogSpot URL.

Comments

Popular posts from this blog

Embedded Comments And Main Page View

The option to display comments, embedded below the post, was made a blog option relatively recently. This was a long requested feature - and many bloggers added it to their blogs, as soon as the option was presented to us. Some blog owners like this feature so much, that they request it to be visible when the blog is opened, in main page view. I would like all comments, and the comment form, to be shown underneath the relevant post, automatically, for everyone to read without clicking on the number of comments link. And this is not how embedded comments work.

What's The URL Of My Blog?

We see the plea for help, periodically I need the URL of my blog, so I can give it to my friends. Help! Who's buried in Grant's Tomb, after all? No Chuck, be polite. OK, OK. The title of this blog is "The Real Blogger Status", and the title of this post is "What's The URL Of My Blog?".

With Following, Anonymous Followers Can't Be Blocked

As people become used to Blogger Following as just another tool to connect people, they start to think about the implications . And we see questions like How do I block someone who's been following my blog secretly? I couldn't see her in my Followers list (hence I couldn't use the "Block this user" link), but I have looked at her profile and could see that she's Following my blog. Following, when you look at the bottom line, is no more than a feed subscription and an icon (possibly) displayed on your blog, and linking back to the profile of the Follower in question. If someone Follows your blog anonymously, all that they get is a subscription to the blog feed. If you publish a feed from your blog, and if the feed is open to anybody (which, right now, is the case ), then it's open to everybody. If someone wants to use Following to subscribe to the feed, you can't stop this. You can't block it before, or after, the fact. You can't Block w