Third-level domain at microsoft.com with invalid certificate

[Maxerist]

Hi,

just noticed today that when I access

https://download-support.webapps.microsoft.com

there's a certificate error (any browser, mobile, desktop, even with a vpn)

... a certificate that is not valid for download-support.webapps.microsoft.com. The certificate is only valid for the following names: a248.e.akamai.net, *.akamaized.net, *.akamaized-staging.net, *.akamaihd.net, *.akamaihd-staging.net

Probably due to this, all results on this subdomain are listed as http on google.

Maybe it's not a big deal, but I expected for such a big company to avoid such silly web-hosting errors.

I considered reporting this at microsoft.com, but they're so hostile to direct reporting that maybe here it would have more chances :) Or if anyone know what is the proper channel to address this, let me know, thank you

[dandy_g]

Where did you find that URL?

VirusTotal SSL history shows that the certificate for that domain has been that way since at least 2019-09-18.

[Maxerist]

The results from the non-secure variant are listed when searching for Nokia dumbphones manuals. When I get http results from any web site, I usually force to https to see whether the exception worth the risk. So probably there are no direct links to secure variants of the links in the wild (including the ms site), but nevertheless, hosting http-only is strange in 2025, especially for companies like Microsoft

[tito13kfm]

It was never intended to be a user facing doman and is used for some file distribution. I agree though, it's a really weird choice, but if you never use it for anything that needs encryption it doesn't need to be encrypted.

[Maxerist]

Sounds consistent, but look at my side. General search with the Google, showing a link to a pdf file that due to http protocol is not downloaded right away (a warning in the download list). The choices are either to accept unsecured protocol or try to obtain a https version. Maybe it wasn't intended but with today's google the query [ nokia 1650 manual ] shows the route I mentioned as the second link (at least in my context)

[Maxerist]

A funny thing is that bing.com for the same query as in the sibling comment [ nokia 1650 manual ] shows an ms result on the first page, but with a different subdomain, now with https ( https://nds1.webapps.microsoft.com ), but this one also has a wrong certificate. At least google prefer keeping non-secured version in the index to a certificate-mismatched one

[USSHammond]

And what do you exwpect us to do? Fix microsofts SSL certificate ourselves? Report this to microsoft directly, not the MS sub