Hacker News Reader

I know from living in Seattle that they're a reputable credit union, but the fact that their home page gives me a certificate error is a bad pattern that trains users to ignore scary red messages. (The problem is that the cert is for www.becu.org , not becu.org .)

View on HN

I think its because they never intended to be linked to without the www.

That's not really an excuse. This is a pretty trivial thing to fix (update the cert, or force a redirect).

They do force a redirect on http://becu.org/, but they can't really force a redirect on https://becu.org/, because you would need to accept the mismatched name before you could get the redirect.

Although, I'm surprised they don't have an alternate name, most of the CA's I've worked with recently automatically add the naked domain as an alternate name when you order a cert with www

Reply on news.ycombinator.com