Charles Jones
Charles JonesTheory — the hypothesis held before the instruments answered
“If the certificate were broken, something would have said so. Silence from the monitoring is the same as health.”
Date — cured 2026-08-04. The record does not establish how long the condition was live, so no duration is claimed.
Symptom
The www host resolved, 301’d to itself over HTTPS, and presented a certificate for
firebaseapp.com. Visitors met NET::ERR_CERT_COMMON_NAME_INVALID — a full-page security
interstitial, not a 404. On a licensed-insurance surface, a certificate warning costs more trust
than a missing page would.
Diagnosis
The host had never been provisioned as a custom domain, so no certificate naming it was ever minted. Measured directly: no alternative certificate subject name matches the www host. Two classic stall causes were checked and cleared — certificate-authority authorization records: none; DNSSEC delegation signer: none — so issuance could not have been blocked by either.
Cure
Provision the host properly as a redirect domain, bracketed by an identical probe before and after, touching no DNS.
Permanent
A hardening step that removes the user’s escape hatch must never ship before the thing it hardens is correct. Strict-transport enforcement here would have converted a dismissible warning into a hard lockout cached in the visitor’s own browser for up to a year, with no override. Fix the certificate first, or never fix it at all — the strengthening was deliberately excluded from this cure and left as a separate decision.
Measured
Post-cure: valid certificate, clean 301 to the apex, 12/12 path fidelity, apex control unmoved. The theory was refuted — nothing had said so, for as long as it had been true. Separately recorded, and the reason this entry names an instrument rather than a promise: the apex certificate carried an expiry 82 days out and the census did not observe a renewal. Auto-renewal is documented; it was not measured.
Sources
Estate record, private: technical-debt ledger TD-104.
Verified at the edge afterwards, not in a console: this site’s own apex and www hosts each carry a dedicated certificate with one subject name, and the expiry is a calendar item rather than an assumption.