"Advanced -> Add Exception -> Confirm Security Exception" is not available in Firefox when HSTS is on.
here is what i got. this is after clicking on "Advanced" which added the box below it.:
http://linuxhomepage.com/free/python-dot...cert-0.png
i clicked on "SSL_ERROR_BAD_CERT_DOMAIN" as seen in blue in that box and got:
http://linuxhomepage.com/free/python-dot...d-cert.txt
yeah i know, Firefox is not very helpful. but this also means a lot of the world cannot read the site. and i deleted Opera over the weekend or i would have tried it in Opera. i did try it in lynx, curl and netget. it looks like may be a mis-signed cert (the reference to "alternate name"). strange that netget went to that IPv6 address, instead of the one that the DNS lookup gets
Output:
lt1/forums /home/forums 11> logcmd -s python-dot-org lynx -mime_header https://python.org/
Script started, file is ./20171114-211703-027668-python-dot-org.log
21:17:03 [27673] EXECUTING: 'lynx' '-mime_header' 'https://python.org/'
Looking up python.org
Making HTTPS connection to python.org
lynx: Can't access startfile https://python.org/
[[ 0m0s real 0.646 - user 0.024 - sys 0.004 - 4.33% ]]
21:17:03 [27673] FINISHED - status = 1
Script done, file is ./20171114-211703-027668-python-dot-org.log
lt1/forums /home/forums 12> a python.org
python.org. 86400 in a 23.253.135.79
lt1/forums /home/forums 13> logcmd -s python-dot-org lynx -mime_header https://23.253.135.79/
Script started, file is ./20171114-211753-027764-python-dot-org.log
21:17:53 [27769] EXECUTING: 'lynx' '-mime_header' 'https://23.253.135.79/'
Looking up 23.253.135.79
Making HTTPS connection to 23.253.135.79
lynx: Can't access startfile https://23.253.135.79/
[[ 0m0s real 0.650 - user 0.016 - sys 0.008 - 3.69% ]]
21:17:53 [27769] FINISHED - status = 1
Script done, file is ./20171114-211753-027764-python-dot-org.log
lt1/forums /home/forums 14> logcmd -s python-dot-org curl https://python.org/
Script started, file is ./20171114-212012-027969-python-dot-org.log
21:20:12 [27974] EXECUTING: 'curl' 'https://python.org/'
curl: (51) SSL: certificate subject name (www.python.org) does not match target host name 'python.org'
[[ 0m0s real 0.803 - user 0.036 - sys 0.008 - 5.47% ]]
21:20:12 [27974] FINISHED - status = 51
Script done, file is ./20171114-212012-027969-python-dot-org.log
lt1/forums /home/forums 15> logcmd -s python-dot-org netget https://python.org/
Script started, file is ./20171114-212322-028269-python-dot-org.log
21:23:22 [28274] EXECUTING: 'netget' 'https://python.org/'
--2017-11-14 21:23:22-- https://python.org/
Resolving python.org (python.org)... 2a04:4e42:9::223
Connecting to python.org (python.org)|2a04:4e42:9::223|:443... connected.
ERROR: no certificate subject alternative name matches
requested host name 'python.org'.
To connect to python.org insecurely, use `--no-check-certificate'.
[[ 0m2s real 2.563 - user 0.004 - sys 0.000 - 0.15% ]]
21:23:24 [28274] FINISHED - status = 5
Script done, file is ./20171114-212322-028269-python-dot-org.log
lt1/forums /home/forums 16> aaaa python.org
python.org. 86400 in aaaa 2001:4802:7901:0:e60a:1375:0:6
lt1/forums /home/forums 17>
i totally missed the part where it gave a list of names that the cert is for. the font was too small and Firefox would not enlarge it. but i finally could read it when i enlarged the image capture. the name "python.org" is not in the list. and re-direction won't work until TLS recognizes the hostname that was used. so they need to get a new cert. this will, unfortunately, cost them another full certificate price, unless it was the CA that made the mistake.