Bug Reports
Tip Monero to Admin 
42DxmL7sdVzHU6fEocXioT1ZPf3n1CThA1HEbPVofKgC6GGG1oPYXXg6mbwMuZE4w3PkBF3UAWjhfMbMpu82dfmFJqGpsCb
Publish Tip to Admin Please login to publish your tip
Tip Monero to Juanperez7 Juanperez7 has not setup a {COIN} tip address yet.
Publish Tip to Juanperez7 Juanperez7 has not setup a {COIN} tip address yet.
Summary
https://www.xmrbazaar.com presents a certificate whose names do not include the www host. The apex sends HSTS with includeSubDomains, so www is forced to HTTPS and fails closed with no proceed link. Links using the www host land users on a security warning instead of the site. Found via a link on a weblog (drukknoopje.nl) pointing at their profile. Their hosting provider reproduced it independently on their own machine and network: the apex URL loads for them, the same path on the www host fails, and they placed the fault on the www certificate.
Email from the mentioned weblog host:
Repro
Open https://www.xmrbazaar.com/
Chrome: NET::ERR_CERT_COMMON_NAME_INVALID, no proceed link (HSTS)
Brave: NET::ERR_CERT_COMMON_NAME_INVALID, no proceed link (HSTS)
Firefox: loads normally
The apex (https://xmrbazaar.com/) is unaffected in all three.
Expected
www serves the site under a cert naming www.xmrbazaar.com, or 301s to the apex over a valid cert.
HSTS state (chrome://net-internals/#hsts)
dynamic_sts_domain: xmrbazaar.com
dynamic_upgrade_mode: FORCE_HTTPS
dynamic_sts_include_subdomains: true
dynamic_sts_observed: 1788900429 (~2026-09-08)
dynamic_sts_expiry: 1820436429 (~2027-09-08)
static_sts_domain: (empty)
Expiry minus observed is 31536000, so max-age is one year. No preload entry, so the policy is header-set and fully under operator control. www holds no policy of its own and inherits the apex one.
What this establishes
www resolves and answers on 443: a handshake started and a cert came back.
That cert's name set omits www.xmrbazaar.com.
includeSubDomains asserts every subdomain speaks valid HTTPS. www does not. Each setting is fine alone; together they produce a hard failure with no click-through.
The policy is re-observed on every apex visit, so the one-year max-age does not lapse for regular users. This will not self-heal.
Scope
Client side only. I have not seen the server config, so I am not asserting whether the cert omits the www SAN or whether www terminates on a different host or edge. The Firefox result is an observation; I did not establish why it differs.
Checks
openssl s_client -connect www.xmrbazaar.com:443 -servername www.xmrbazaar.com /dev/null | openssl x509 -noout -subject -ext subjectAltName
dig +short www.xmrbazaar.com
curl -sSI https://xmrbazaar.com | grep -i strict-transport-security
Potential Fix
Reissue the certificate so it carries both the apex and the www host, and add a server-level 301 from www to the apex so the canonical URL is unchanged. On Let's Encrypt that is a second -d flag on the existing certbot command.
Two things that do not work: removing the www DNS record leaves every browser holding the cached policy still forcing HTTPS on www, and dropping includeSubDomains takes up to a year to age out. Issuing the cert for both names is the only fast path.
Impact
Third-party links using the www host, including the one on the weblog, show users an unskippable warning about attackers intercepting passwords and messages.
Leaving users confused.
Tip Monero to SoulReaver 
8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm
Publish Tip to SoulReaver Please login to publish your tip
Tip Monero to Juanperez7 Juanperez7 has not setup a {COIN} tip address yet.
Publish Tip to Juanperez7 Juanperez7 has not setup a {COIN} tip address yet.
Tip Monero to UsualCat UsualCat has not setup a {COIN} tip address yet.
Publish Tip to UsualCat UsualCat has not setup a {COIN} tip address yet.
Tip Monero to UsualCat UsualCat has not setup a {COIN} tip address yet.
Publish Tip to UsualCat UsualCat has not setup a {COIN} tip address yet.
Tip Monero to stonego stonego has not setup a {COIN} tip address yet.
Publish Tip to stonego stonego has not setup a {COIN} tip address yet.
Tip Monero to WiseGuy92 WiseGuy92 has not setup a {COIN} tip address yet.
Publish Tip to WiseGuy92 WiseGuy92 has not setup a {COIN} tip address yet.
Tip Monero to SoulReaver
8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm
Publish Tip to SoulReaver Please login to publish your tip
Tip Monero to 42069 
864bSsnpgq9guUzu54XvftLnX4EaDqHJ1hH8TqGVmB3jdK8KLSAgvA4AH2in11SpbYZravVpTr7C9AQATTaSuwYu1A26WDV
Publish Tip to 42069 Please login to publish your tip
Tip Monero to NataL1na24 NataL1na24 has not setup a {COIN} tip address yet.
Publish Tip to NataL1na24 NataL1na24 has not setup a {COIN} tip address yet.
Target URL: https://xmrbazaar.com/messenger/schnur/
Affected Account: schnur
Description:
The messenger interface for user schnur does not display an associated public PGP key. End-to-end encrypted messaging and cryptographic identity verification cannot be established for this trade/chat session.
Steps to Reproduce:
Open active messenger session at https://xmrbazaar.com/messenger/schnur/.
Inspect the user details / key section.
Observe that no public PGP key is present or bound to the account.
Expected Behavior:
The user's public PGP key should be rendered on the messenger view, or the platform should enforce public key association for active trading/messaging profiles.
Tip Monero to SoulReaver
8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm
Publish Tip to SoulReaver Please login to publish your tip
Tip Monero to glamorous_oak 
852XVfJZLuXC5FGqTNXdKB7c8AwLgWgTfH8Kr2P48VAAKbGSXyBXV2qDYwyHScfGhTRLaM1C3CdzogtgUAeZVxQC7hw4KHy
Publish Tip to glamorous_oak Please login to publish your tip
Tip Monero to NoReply NoReply has not setup a {COIN} tip address yet.
Publish Tip to NoReply NoReply has not setup a {COIN} tip address yet.
Tip Monero to schnur schnur has not setup a {COIN} tip address yet.
Publish Tip to schnur schnur has not setup a {COIN} tip address yet.