Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

index.docker.io was serving an expired certificate

index.docker.io

Post reply on HN
Print view View original

11–20 of 26 posts

Re: index.docker.io was serving an expired certificate

#11

Post by agwa »

Sxw1212 wrote: post #3

I've seen this happen to multiple sites and was wondering if there was a reason why some CAs don't let you issue a new cert until the day of the expiry. It doesn't seem like that would open up much of an attack surface.

I've never heard of a CA doing that. By and large, the reason why this happens is human error - no one knows the cert is about to expire because it's not being monitored and/or the email from the CA (if they even send one) goes to a mailbox that's not being read.

But there's no reason why a rote task like renewing a certificate should be left to humans. It should be automated, which is what my startup, https://sslmate.com/, is doing.

Re: index.docker.io was serving an expired certificate

#12

Post by zobzu »

Sxw1212 wrote: post #10
jlgaddis wrote: post #6

Earlier quoted context omitted.

Which CAs do that? I get alerts from our monitoring system 30d prior to expiration and have not had any problems generating new certs then (and they expire on the same day as the previous -- i.e., I don't "lose" three weeks if I renew three weeks early).

I'm using StartSSL for a personal site and it didn't let me generate a new one until it had almost expired. I'm using the free verification though, it might be different now or for their paid versions.

well 15 days, isnt that bad.

Re: index.docker.io was serving an expired certificate

#13

Post by WestCoastJustin »

For anyone interested. If you are running Nagios/Sensu, then I highly suggest using one of the ssl check plugins [1, 2, 3], which will give you a heads up about these types of these before they happen. Then the onus is not on you to check some calendar/spreadsheet for expiring certs. Same goes for domains [4, 5]. When you are looking after tons of services, ssl certs, and domains, it is inevitable that things will slip through the cracks unless you have some type of monitoring keeping tabs on it for you.

[1] http://exchange.nagios.org/directory/Plugins/Network-Protoco...

[2] http://exchange.nagios.org/directory/Plugins/Network-Protoco...

[3] https://github.com/sensu/sensu-community-plugins/tree/master...

[4] http://exchange.nagios.org/directory/Plugins/Internet-Domain...

[5] https://github.com/sensu/sensu-community-plugins/tree/master...

Re: index.docker.io was serving an expired certificate

#16

Post by ams6110 »

WestCoastJustin wrote: post #13

For anyone interested. If you are running Nagios/Sensu, then I highly suggest using one of the ssl check plugins [1, 2, 3], which will give you a heads up about these types of these before they happen. Then the onus is not on you to check some calendar/spreadsheet for expiring certs. Same goes for domains [4, 5]. When you are looking after tons of services, ssl certs, and domains, it is inevitable that things will sl…

Every CA I've ever used sends reminder emails. The problem is they are probably going to some un-read administrative email address.

Re: index.docker.io was serving an expired certificate

#17

Post by [deleted] »

ams6110 wrote: post #16
WestCoastJustin wrote: post #13

For anyone interested. If you are running Nagios/Sensu, then I highly suggest using one of the ssl check plugins [1, 2, 3], which will give you a heads up about these types of these before they happen. Then the onus is not on you to check some calendar/spreadsheet for expiring certs. Same goes for domains [4, 5]. When you are looking after tons of services, ssl certs, and domains, it is inevitable that things will sl…

Every CA I've ever used sends reminder emails. The problem is they are probably going to some un-read administrative email address.

[deleted]

Re: index.docker.io was serving an expired certificate

#19

Post by homakov »

agwa wrote: post #11
Sxw1212 wrote: post #3

I've seen this happen to multiple sites and was wondering if there was a reason why some CAs don't let you issue a new cert until the day of the expiry. It doesn't seem like that would open up much of an attack surface.

I've never heard of a CA doing that. By and large, the reason why this happens is human error - no one knows the cert is about to expire because it's not being monitored and/or the email from the CA (if they even send one) goes to a mailbox that's not being read. But there's no reason why a rote task like renewing a certificate should be left to humans. It should be automated, which is what my startup, https://sslmat…

you should put cert checker on top, seems like a great feature
Post reply on HN