My extensions are still running. I even restarted Firefox a few moments ago. So it’s not everyone?
Mine is still working. I set the system time forward 2 days and restarted Firefox and the extensions still work.
All extensions disabled due to expiration of intermediate signing cert
191–200 of 955 posts
Re: All extensions disabled due to expiration of intermediate signing cert
#192Earlier quoted context omitted.
Security tends towards the lowest common denominator. I'd rather you just figured out how to run a cron job. The problem comes if your keys ever get compromised or cracked all your historical traffic becomes vulnerable instead of just the most recent window.
Yeah "just" a cron job except the implementation changes several times a year. Somehow this automated process was more time-consuming than the previous, manual one.
Many cloud providers will make this process pretty much entirely automated. But let's say you don't want to do that: when is the last time the way you run caddy changed? Or the last time python-certbot-nginx changed?
Re: All extensions disabled due to expiration of intermediate signing cert
#193Earlier quoted context omitted.
> Still, this type of oversight seems all too common even in large companies. (...) Has anyone developed a tool designed specifically to avoid certificate expiry disasters? LetsEncrypt renewal is supposed to be automated. [1] I know of a company that hosted blogs for thousands of customers. They used LetsEncrypt, but the CTO considered automatic renewals a possible security risk, so they did it manually. Problem is,…
I have no idea why you'd deliberately wait the full 90 days to do a manual renew. For reasons, I renew manually, but every 60 days or so. Nowhere close to the deadline.
Exactly.
Their FAQ [1] recommends exactly that: renewing every 60 days.
[1] https://letsencrypt.org/docs/faq/#what-is-the-lifetime-for-l...
Re: All extensions disabled due to expiration of intermediate signing cert
#194Earlier quoted context omitted.
Its also more secure. Long lived certs risk the possibility that someone who used to own the domain got a certificate on it and it still works after the domain is resold. Once you automate it there is no downside to short lived certs.
If only there were a way to revoke certificates. Like, some kind of list.
CRLs do not work in practice, and major clients routinely ignore them.
Re: All extensions disabled due to expiration of intermediate signing cert
#195Earlier quoted context omitted.
> Still, this type of oversight seems all too common even in large companies. (...) Has anyone developed a tool designed specifically to avoid certificate expiry disasters? LetsEncrypt renewal is supposed to be automated. [1] I know of a company that hosted blogs for thousands of customers. They used LetsEncrypt, but the CTO considered automatic renewals a possible security risk, so they did it manually. Problem is,…
Some shared hosting like Bluehost now provide LetsEncrypt by default for all their sites with auto-renewal (But I don't recommend Bluehost shared plans for anything even closer to serious hobby due to absurd downtimes like most other shared hosting). I used manual renewal for LetsEncrypt for about 4 websites on other shared hosts & renewing them every 3 months was a pain; had to keep reminders and schedules just not…
Another option is using a Web Server/Reverse Proxy that supports Let's Encrypt automatically, like Caddy [1]. I believe Apache HTTPD has partial support [2], too.
Re: All extensions disabled due to expiration of intermediate signing cert
#196This is a goddamned disaster. I'm just thankful that I use an offline password manager, but even still ... I like FF, don't get me wrong, but this is going to absolutely fucking destroy user trust in Mozilla. This kind of incompetence, on a browser scale , is breathtaking.
I dunno. I’m a typical Firefox user, and I’d rather jump off a bridge than switch to a different browser because of a fuckup like this. People make mistakes, but Mozilla still stands for things that certain other browser vendors don’t, last time I checked.
Once Palemoon went to crap Firefox is the last one that does what I want. Good luck mozilla, I'm sure you guys are losing your minds right now.
Re: All extensions disabled due to expiration of intermediate signing cert
#197This is a goddamned disaster. I'm just thankful that I use an offline password manager, but even still ... I like FF, don't get me wrong, but this is going to absolutely fucking destroy user trust in Mozilla. This kind of incompetence, on a browser scale , is breathtaking.
Still beats using Chrome.
Absolutely. 100% true.
Re: All extensions disabled due to expiration of intermediate signing cert
#198First they force code signing on everyone without a way to disable it then they break it. This is an extreme level of incompetence I didn't expect from Mozilla. They'd better have the best post mortum ever, possibly with someone being fired.
Come on, people make mistakes. Things fall through cracks. Shit happens, etc. No one needs to be fired for a single instance of a particular mistake. If this happened multiple times, then I would be on board with firing someone.
Mistakes of this magnitude are always singular and particular. Hopefully.
Re: All extensions disabled due to expiration of intermediate signing cert
#199Earlier quoted context omitted.
Discovery of all the certs is what I think is the harder problem.
I agree. What can be done to prevent developers from adding a certificate dependency without monitoring during the move-fast-and-break-things days of early development, which then sits for X years as developers come and go, and nobody notices until it fails?
Certificate Transparency works pretty darn well for most usecases, we (Latacora) have found while trying to solve exactly this problem (or at least the figure out which certs exist that aren't being regularly re-issued part) :-)
Re: All extensions disabled due to expiration of intermediate signing cert
#200I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…
We scan our codebase for anything that looks like a cert and send emails when it gets close. Might not have helped here if it was an intermediate owned by a CA. There but for the grace of God go I.
If you want to get rid of those and they're public certs: odds are they're in Certificate Transparency logs and you can monitor them from there.