Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Githubassets.com Cert Has Expired

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 55 posts

Re: Githubassets.com Cert Has Expired

#31

Post by contravariant »

gregoriol wrote: post #23
mg wrote: post #18

This is a script I call "certdays.sh" which you can call from your regular tests like this: certdays.sh somedomain.com 14 If the certificate for somedomain.com is valid less then 14 days, it will fail: https://github.com/no-gravity/certdays

Don't call it from tests though, call it from a monitoring system!

In case anyone is looking for a good option, I've had great success with InfluxDB's telegraph utility which automatically checks both uptime and certificates for HTTPS endpoints, combined with a grafana dashboard that sends alerts when the deadline approaches.

Re: Githubassets.com Cert Has Expired

#32

Post by nkrisc »

ta8645 wrote: post #7

Maybe browsers should put up a warning when a certificate is about to expire; say two weeks away. Nobody should let their certificate get that close to expiring, but if it does, you'd rather it generate a lot of visible warnings before simply ceasing to work at all.

I don't agree. A cert that is just about to expire is as valid as one that's new. It only has two states: expired or not. For the user is either expired or not, they needn't be concerned until it actually is expired.

Re: Githubassets.com Cert Has Expired

#33

Post by KingOfCoders »

diggan wrote: post #26
KingOfCoders wrote: post #22

Earlier quoted context omitted.

Tests can have bugs too.

Indeed, that's true! Not only you have to write the tests, you also have to verify it's working, and have monitoring connected to ensure it's continuously working. But still, multi-million companies should surely be able to handle that.

Verify that it is working after changes, with a test? What is testing that test?

Re: Githubassets.com Cert Has Expired

#34

Post by tfsh »

ta8645 wrote: post #7

Maybe browsers should put up a warning when a certificate is about to expire; say two weeks away. Nobody should let their certificate get that close to expiring, but if it does, you'd rather it generate a lot of visible warnings before simply ceasing to work at all.

Crowd sourcing errors by relying on user generated reports is sometimes a good idea, however in this instance it's not. Cert expiry is something that can be automated and monitored because the expiry is deterministic. Crowd sourcing is for the non-deterministic.

Re: Githubassets.com Cert Has Expired

#37

Post by switch007 »

mschuster91 wrote: post #30
unilynx wrote: post #25

if you're using nagios, setup something like command_name check_certificate command_line $USER1$/check_http -H $ARG1$ -p $ARG2$ -4 -S -C 21 -t 20 --sni this won't warn about certificate name mismatches though

That warns only after the fact, not in advance... depending on how the infrastructure (and especially the cert procuring process, for those not using LE for whatever reason) is set up, too late.

Nagios checks have thresholds for WARNING and CRITICAL. With these kind of checks it's usually 'days until expiry', so it certainly can be used to warn in advance.

Re: Githubassets.com Cert Has Expired

#39

Post by diggan »

KingOfCoders wrote: post #33
diggan wrote: post #26

Earlier quoted context omitted.

Indeed, that's true! Not only you have to write the tests, you also have to verify it's working, and have monitoring connected to ensure it's continuously working. But still, multi-million companies should surely be able to handle that.

Verify that it is working after changes, with a test? What is testing that test?

If you change something, don't you manually check that it's actually doing what you want it to?

If I was an engineer changing a test regarding SSL certs expiry time, after a change, I'd test it with a cert that has expired, about to expire and one far in the future. Manually or automated doesn't really matter, but test your changes after you've done them. Really basic stuff.

Re: Githubassets.com Cert Has Expired

#40

Post by mgkimsal »

ta8645 wrote: post #7

Maybe browsers should put up a warning when a certificate is about to expire; say two weeks away. Nobody should let their certificate get that close to expiring, but if it does, you'd rather it generate a lot of visible warnings before simply ceasing to work at all.

perhaps a plugin which admins can add to their browsers to act as a reminder for themselves? having core browsers warn the general public about this all the time will lead to chaos.
Post reply on HN