O2 outage due to expired Ericsson certificate
ericsson.com
O2 outage due to expired Ericsson certificate
1–10 of 96 posts
Re: O2 outage due to expired Ericsson certificate
#2Why do certificates expire? How is it acceptable to have a piece of data somewhere that contains a timebomb that must be periodically defused? I do not see how this helps security, and it is particularly ridiculous that normal behavior is that one day the system works normally and is deemed secure, and the next day it is so insecure and dangerous that communication simply fails.
Re: O2 outage due to expired Ericsson certificate
#3Ignoring letting it expire in the first place.
The surprising part is it took over 24 hours to restore service. I currently still have 3G only, and that's struggling (apparently 4G will follow).
Re: O2 outage due to expired Ericsson certificate
#4Why do certificates expire? How is it acceptable to have a piece of data somewhere that contains a timebomb that must be periodically defused? I do not see how this helps security, and it is particularly ridiculous that normal behavior is that one day the system works normally and is deemed secure, and the next day it is so insecure and dangerous that communication simply fails.
I agree with you, but I suspect the intention is to prevent another type of timebomb. One where one day the system works and everything is considered secure, and then 25 years later nobody has given it a second thought.
Re: O2 outage due to expired Ericsson certificate
#5This was a major outage in the UK causing millions of people not to have data access on their phones.
Re: O2 outage due to expired Ericsson certificate
#6Why do certificates expire? How is it acceptable to have a piece of data somewhere that contains a timebomb that must be periodically defused? I do not see how this helps security, and it is particularly ridiculous that normal behavior is that one day the system works normally and is deemed secure, and the next day it is so insecure and dangerous that communication simply fails.
> Why do certificates expire?
I always assumed one reason is so revocation lists don't become huge. Also, digital properties such as domains change hands.
Re: O2 outage due to expired Ericsson certificate
#7Why do certificates expire? How is it acceptable to have a piece of data somewhere that contains a timebomb that must be periodically defused? I do not see how this helps security, and it is particularly ridiculous that normal behavior is that one day the system works normally and is deemed secure, and the next day it is so insecure and dangerous that communication simply fails.
I agree with you, but I suspect the intention is to prevent another type of timebomb. One where one day the system works and everything is considered secure, and then 25 years later nobody has given it a second thought.
Yes. Even then, a few years is too long, because you forget about the need for renewal.
I would say that the "proper" use of certificate expiry is the way LetsEncrypt and other ACME providers do it: it's set so low that you need an automated renewal process in order to make the certificate at-all useful.
Re: O2 outage due to expired Ericsson certificate
#8Ooh - I was wondering what the hell was going on.
I assumed I had dropped the darn thing one too many times.
Glad to see the HN grapevine works on wifi.
It is a reminder of just how fragile this digital world still is - we are taking technology designed to survive nuclear war, and adding single points of failure.
Let's look at mesh networking again.
Re: O2 outage due to expired Ericsson certificate
#9Why do certificates expire? How is it acceptable to have a piece of data somewhere that contains a timebomb that must be periodically defused? I do not see how this helps security, and it is particularly ridiculous that normal behavior is that one day the system works normally and is deemed secure, and the next day it is so insecure and dangerous that communication simply fails.
The problem is what is someone screws up and compromises the key? By having an expiration we ensure that in the worst case they get just a few years to do damage.
Re: O2 outage due to expired Ericsson certificate
#10Why do certificates expire? How is it acceptable to have a piece of data somewhere that contains a timebomb that must be periodically defused? I do not see how this helps security, and it is particularly ridiculous that normal behavior is that one day the system works normally and is deemed secure, and the next day it is so insecure and dangerous that communication simply fails.
Seriously? Any half decent administrator knows that for every SSL certificate you install, you set a date some time in the future where you need to change it out for a new one.
To your comment of "one day the system works normally and is deemed secure, and the next day it is so insecure and dangerous", this is working as intended. The certificate is to establish trust and identity along with encrypting the data in transit. The identity described by the certificate is only valid up until the expiry date after which it ceases to be valid for that purpose. You now have an encrypted connection to something that can't prove its identity, which is certainly a lower level of "secure" than what it was before the certificate expired.
Ignoring expiry dates would mean any keys that were compromised ever could be used for MITM attacks and no one would be the wiser.