index.docker.io was serving an expired certificate
index.docker.io
index.docker.io was serving an expired certificate
1–10 of 26 posts
Re: index.docker.io was serving an expired certificate
#2Re: index.docker.io was serving an expired certificate
#3I've seen this happen to multiple sites and was wondering if there was a reason why some CAs don't let you issue a new cert until the day of the expiry. It doesn't seem like that would open up much of an attack surface.
Re: index.docker.io was serving an expired certificate
#4http://status.docker.com/
While the issue is frustrating, I commend them on having an up-to-date status page.
Re: index.docker.io was serving an expired certificate
#5This in turn means that you can't pull any docker images if they're on the public index, e.g:
:~ $ sudo docker pull debian Pulling repository debian 2015/03/20 23:42:18 Get https://index.docker.io/v1/repositories/debian/images: x509: certificate has expired or is not yet valid
Thankfully it's a Friday night, so I'm taking this as a hint to start my weekend :)
Re: index.docker.io was serving an expired certificate
#6I've seen this happen to multiple sites and was wondering if there was a reason why some CAs don't let you issue a new cert until the day of the expiry. It doesn't seem like that would open up much of an attack surface.
Which CAs do that? I get alerts from our monitoring system 30d prior to expiration and have not had any problems generating new certs then (and they expire on the same day as the previous -- i.e., I don't "lose" three weeks if I renew three weeks early).
Re: index.docker.io was serving an expired certificate
#7Re: index.docker.io was serving an expired certificate
#8Oops.
This is a wildcard cert for .docker.io.
In addition, Chromium tells me that "Your connection to docker.io is encrypted with obsolete cryptography" (although that may just be a result of the expired certificate?).
How did no one responsible for this get notified prior to the certificate expiring? Presumably, that's something they (Docker) will shortly be adding to their monitoring system.
ETA: I'm no expert but after looking at the Qualys SSL Labs report [0], it would appear that the warning is simply due to the certificate having expired.
[0]: https://www.ssllabs.com/ssltest/analyze.html?d=docker.io&lat...
Re: index.docker.io was serving an expired certificate
#9I've seen this happen to multiple sites and was wondering if there was a reason why some CAs don't let you issue a new cert until the day of the expiry. It doesn't seem like that would open up much of an attack surface.
If your CA doesn't let you renew your cert well in advance of expiry (which I find hard to believe), get a new cert on a different CA. You can have multiple certs valid for the same domain name, from different providers; the active cert is the one you serve.
Re: index.docker.io was serving an expired certificate
#10I've seen this happen to multiple sites and was wondering if there was a reason why some CAs don't let you issue a new cert until the day of the expiry. It doesn't seem like that would open up much of an attack surface.
Which CAs do that? I get alerts from our monitoring system 30d prior to expiration and have not had any problems generating new certs then (and they expire on the same day as the previous -- i.e., I don't "lose" three weeks if I renew three weeks early).
I'm using StartSSL for a personal site and it didn't let me generate a new one until it had almost expired. I'm using the free verification though, it might be different now or for their paid versions.