31–40 of 163 posts
Does anyone know if Bing has any SSL-only clients? Like do any of their toolbars or built-in search widgets in Windows use SSL by default?
The real question is, why were you on bing? :P
I made a site that checked for SSL cert expirations and misconfigurations, but I couldn't acquire any customers. I still think there's a business there somewhere, although maybe it really only sells as part of another product. Edit: If anyone wants a script to check their certificates, here you go: https://gist.github.com/bretwalker/5420652 . You'll just need to add in some sort of notification logic, especially for…
Stackify created this exact thing after the last time this happened with MS Azure about 2 months ago. It's called certalert.me ( http://certalert.me ) and is a free service. It's not a huge business, but it was almost trivial to setup with all the advanced monitoring & diagnostics that stackify typically does anyway.
I also can't tell if certalert.me checks for hostname mismatches. That was another part of my service, because a misconfiguration is just as fatal as an expired certificate.
This is the second major flub this year. Azure's cert expired in prod not many weeks ago.
Basically Akamai is using the same ssl certifate on (most?) of its edge servers. The reason for that is that traditionally it is difficult to decide for a server that is serving multiple domains, which SSL certificate to show for a client -- the HTTP header, which contains the hostname is sent way after the certificate information has been exchanged.
A certificate can contain several hostnames (in the SubjectAlternativeName extension) - but that does not scale if you have a big number of sites for a number of reasons (re-signing the certificate all the time is a nuisance, browser behavior with certificates containing several thousand hostnames is kind of fun, etc.).
Nowadays there are solutions to that problem (using the Server Name Indication TLS extension -- which basically sends the desired hostname in the TLS exchange before the certificate is exchanged). However, the number of sites actively using SNI is very low - google is the only site known to me that is doing it (try accessing google.com with/without SNI and you will get completely different certificates).
The reason why SNI is not yet that much used is that client support is still a bit flaky. Afaik it is supported by all recent desktop browsers. However, I think the XP TLS stack does not support it (and there are still enough users on that), android only supports it starting with version 3.0, etc.
So - at the moment you basically still need a separate IP for each site (or at least one IP for sites that can share one certificate).
I don't know if akamai also supports custom SSL certificates. Facebook seems to use kind of an interesting mix between akamai and self-hosting - facebook.com itself seems to be hosted by facebook. However, if you use facebook over ssl and check the url of served profile pictures, you will see that they go to https://fbcdn-profile-a.akamaihd.net (or similar) -- hence to one of the hostnames that is mentioned in the akamai edge certificates.
25000 more employees can't fix this kind of incompetence.
The real question is, why were you on bing? :P
I couldn't find something on google, so I decided to give it a try. Can't hurt. I wanted to find out if anyone has done a study on language confusion(the effect where Russians have a hard time getting good at Polish because they confuse Polish words with Russian ones). Still can't find it ;)
this is my favorite http://translate.google.com/#ru/pl/%D0%BA%D0%BE%D0%B2%D0%B5%... (in polish it sounds like 'caviar in a can')
Looks like someone pushed the wrong SSL cert to production: www.bing.com uses an invalid security certificate. The certificate is only valid for the following names: a248.e.akamai.net , *.akamaihd.net , *.akamaihd-staging.net (Error code: ssl_error_bad_cert_domain)
http://revealingerrors.com/akamai_ssl
Earlier quoted context omitted.
http://revealingerrors.com/akamai_ssl
The post does not explain why Akamai's cert is being used. If bing over SSL were working correctly in the past---which I believe to be true---and given that Bing were using Akamai in the past, why the problem now?