11–20 of 52 posts
A month after what? September 27th is what?
Look at the dates on the posts in the thread. He gave them a month before coming back and chastizing them again to find out they'd closed the ticket without fixing it. This is pretty damn pathetic (1), that's all I can think to even say. (1) esp given that the cert expired in MAY.
The SSL certificate expired Tuesday, May 8, 2012. Pro tip: Set up monitoring alerts on your SSL certs to alert your sys admin when they are getting close. For example, here's a Nagios SSL expiration alert: http://exchange.nagios.org/directory/Plugins/Network-Protoco...
The SSL certificate expired Tuesday, May 8, 2012. Pro tip: Set up monitoring alerts on your SSL certs to alert your sys admin when they are getting close. For example, here's a Nagios SSL expiration alert: http://exchange.nagios.org/directory/Plugins/Network-Protoco...
Why do companies buy certs one year at a time? You can make certs for ten, even twenty years. This all goes back to the SSL cartel wanting control. Just make a cert good until January 19, 2038 and get it over with.
Self-signed certs won't fly for public-facing websites.
CAs simply won't issue for more than 3 years, typically. They want to make money, and the easiest way to make more money is to make certificate lifetimes short.
There's an arguable security concern. If a site's cert gets compromised and it's not detected, having a shorter cert lifetime might in some situations prevent the compromise from persisting more than the certificate lifetime. True, if the server is compromised, you can replace certs every year and they'll all be compromised, but if it's a server farm with frequent reinstalls from trusted base media, server compromises won't necessarily persist, and compromised 5+ year website certificates might turn into the weakest link.
If the site must pass periodic scans (for example, by one of those PCI compliance outfits), most of those scanners consider more than 3 years to be "too long" for a cert to be valid. Whether they'd fail the site for that, I don't know.
The SSL certificate expired Tuesday, May 8, 2012. Pro tip: Set up monitoring alerts on your SSL certs to alert your sys admin when they are getting close. For example, here's a Nagios SSL expiration alert: http://exchange.nagios.org/directory/Plugins/Network-Protoco...
The standard https check has it built-in with the right flags. Use -h or --help to figure it out. (They provide different output)
/usr/lib/nagios/plugins/check_http --ssl -C 30 -H contracts.comcast.com
CRITICAL - Certificate expired on 05/08/2012 23:59.
I think the worst was I contacted them on twitter about several hosts that were hammering one of our mail servers, around a million lookups for usernames a day for each domain.
I blocked the IP's, problem solved, but wanted them to nuke the accounts. They said to send in the relevant data. I nicely formatted all the data, snipped sections here and there, and tar'd the files.
Emailed them in and was told they don't know what a tar file is. Sent them in gzip, they can't open them. Finally said screen it and posted the data to pastebin in plain text and sent them the raw link. They didn't know what to do with it.
At some point, I just gave up.
The SSL certificate expired Tuesday, May 8, 2012. Pro tip: Set up monitoring alerts on your SSL certs to alert your sys admin when they are getting close. For example, here's a Nagios SSL expiration alert: http://exchange.nagios.org/directory/Plugins/Network-Protoco...
It amazes me that these SSL errors stay this way so long. Even google has been guilty of this in the past.
Why do companies buy certs one year at a time? You can make certs for ten, even twenty years. This all goes back to the SSL cartel wanting control. Just make a cert good until January 19, 2038 and get it over with.
You usually can't, for several reasons. Self-signed certs won't fly for public-facing websites. CAs simply won't issue for more than 3 years, typically. They want to make money, and the easiest way to make more money is to make certificate lifetimes short. There's an arguable security concern. If a site's cert gets compromised and it's not detected, having a shorter cert lifetime might in some situations prevent the…