Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stackoverflow HTTPS Error – Heartbleed Bug

stackoverflow.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#11

Post by Nick-Craver »

luma wrote: post #4

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after patching impacted OpenSSL instances. It looks like they instead have switched over to a previously-issued wildcard cert for *.stackexchange.com. The cert is valid, but it's for the wrong domain. This is more likely the result of a sysadmin screwing up the respo…

We are actually waiting on a re-issue of a combined wildcard at the moment, but as DNS propagates you'll be served a previous, still valid cert in the interim.

We hope to get the final cert deployed within the hour...as soon as we have it in hand. Our other certs are queued up and ready to do on a secondary load balancer.

CAs are understandably a bit busier than normal today.

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#12

Post by Nick-Craver »

Yuioup wrote: post #10

Does IIS running on Windows have the same security vulnerability? Or is Stackoverflow running on Linux+Mono?

Our load balancer is HAProxy which also does SSL termination, so IIS is not involved with SSL certificates or termination in our setup. Also, the vulnerability was specific to OpenSSL.

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#14

Post by toomuchtodo »

luma wrote: post #4

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after patching impacted OpenSSL instances. It looks like they instead have switched over to a previously-issued wildcard cert for *.stackexchange.com. The cert is valid, but it's for the wrong domain. This is more likely the result of a sysadmin screwing up the respo…

> This is more likely the result of a sysadmin screwing up the response and not bothering to check the work.

As an experienced operations/admin individual, I'd ask for a little courtesy for them. Screwing up the response? Possible. But in some cases, our options are few, and the one that provides the least breakage is what we roll with. Sometimes, there aren't any other options.

TL;DR Sometimes, we have to break shit to make it work, but its less broken than before.

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#15

Post by spolsky »

Nick-Craver wrote: post #11
luma wrote: post #4

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after patching impacted OpenSSL instances. It looks like they instead have switched over to a previously-issued wildcard cert for *.stackexchange.com. The cert is valid, but it's for the wrong domain. This is more likely the result of a sysadmin screwing up the respo…

We are actually waiting on a re-issue of a combined wildcard at the moment, but as DNS propagates you'll be served a previous, still valid cert in the interim. We hope to get the final cert deployed within the hour...as soon as we have it in hand. Our other certs are queued up and ready to do on a secondary load balancer. CAs are understandably a bit busier than normal today.

n.b. Nick is a Stack Exchange system administrator

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#16

Post by AjithAntony »

luma wrote: post #4

I don't think this is the bug per se, but it may very well be due to their reaction to the bug. The safe response for secure systems is to reissue certs after patching impacted OpenSSL instances. It looks like they instead have switched over to a previously-issued wildcard cert for *.stackexchange.com. The cert is valid, but it's for the wrong domain. This is more likely the result of a sysadmin screwing up the respo…

Maybe the cert was different before this moment, but yeah, the CN is *.stackexchange.com, but it has suitable Subject Alternative Names for the other domains.

Re: Stackoverflow HTTPS Error – Heartbleed Bug

#17

Post by Nick-Craver »

We have now deployed new keys and certificates across our network after patching the vulnerability immediately this morning. Forward secrecy was used previously and still is, drastically limiting the surface area/usability of the attack in our case.

You can view stackoverflow.com's current public SSL test here: https://www.ssllabs.com/ssltest/analyze.html?d=stackoverflow...

Nick Craver Stack Exchange Systems Administrator

Post reply on HN