I have a visualforce page with an iframe'd app. When you click a link in the iframe, it communicates with the parent window via postMessage and instructs the JS running on the parent window (visualforce page) to perform a window.open(url, '_blank').
The parent page hostname is like: https://foobar.na6.visual.force.com
The window.open hostname is like: https://snafu.foobar.na6.visual.force.com
I'm then getting a "Privacy Error" in chrome. It says:
[!] Your connection is not private
Attackers might be trying to steal your information from snafu.foobar.na6.visual.force.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID
This server could not prove that it is snafu.foobar.na6.visual.force.com; its security certificate is from *.na6.force.com. This may be caused by a misconfiguration or an attacker intercepting your connection.
In chrome, this error happens every time we click the link, and we have to manually choose to proceed to the site.
Is there something we can do on our end to make this issue go away, or is this something SFDC needs to resolve?