Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CA Root expired on 30 May 2020

support.sectigo.com

Post reply on HN
Print view View original

131–140 of 154 posts

Re: CA Root expired on 30 May 2020

#131

Post by cmbuckley »

encoderer wrote: post #23
jeffbee wrote: post #20

Quick reminder from your friendly local SRE: never ever issue certificates that expire on weekends. Make certs expire in the middle of the afternoon on a business day wherever your operators live and work. The cert in question expires at May 30 10:48:38 2020 GMT, which smells suspiciously like a fixed time after the cert was generated, rather than at a well-chosen point in time.

Great tip. Did you notice that cert in this case was issued 20 years ago? It’s crazy to me that it was still being used to sign certs as recently as last week (according to twitter)

Certificates issued with this CA will have been cross-signed by the newer root certificate, but our CA (Sectigo) was sending the old chain in issuing emails as late as April this year, despite the cross-signed root being available for a long time.

Re: CA Root expired on 30 May 2020

#132

Post by jakub_g »

dredmorbius wrote: post #107
jakub_g wrote: post #54

Earlier quoted context omitted.

Someone on Twitter (forgot whom, maybe swiftonsecurity?) suggested lately in a tongue-in-cheek way that the certs should not hard-expire, but instead add an exponentially-increasing slowdown at TLS handshake. Once the slowdown is too big, someone will notice and have a look.

Unfortunately, given crypto algo evolution and Moore's Law, the reverse is more likely true. Though that would be a neat hack.

I don't understand how this is relevant. We're talking about a deterministic timeout, based on the diff between cert exp date and current date.

If Chrome added e.g. a 20 second slowdown to connect to the page for every user in the world one day after the cert expired, surely there would be some users who would ping the company that the site is unbearably slow (on social media, by email, whatever). Or someone in the company would notice. Or analytics would drop like hell.

Myriads of ways how a non-abandoned website would learn about it directly or indirectly.

Of course that seems like a giant hack, but a grace period of 1-7 days with browsers doing something less scary than a giant error screen would be more than welcome.

Re: CA Root expired on 30 May 2020

#133

Post by pwdisswordfish2 »

AmericanChopper wrote: post #128
pwdisswordfish2 wrote: post #127

Earlier quoted context omitted.

You can authenticate outside of the insecure channel. There is a real world outside of the internet. It is this "manual authentication" that the CA system does not account for. It is not an option. Why is it that, in practice, the only certificates an end user's "CA" can sign are the end user's server certificates?

> You can authenticate outside of the insecure channel. There is a real world outside of the internet. Exactly, and you can look at how much of a failure PGP has been to see how successful that approach is. > Why is it that, in practice, the only certificates an end user's "CA" can sign are the end user's server certificates? CAs can sign any X.509 certificate. They only authenticate domain control or business owners…

"CAs can sign any X.509 certificate."

Please explain how a user who creates a CA pem file with openssl can sign the certificate from example.com. Not a faked up certificate for example.com but the real one the owner of the example.com domain name got from Digicert.

Re: CA Root expired on 30 May 2020

#134

Post by Thorrez »

oarsinsync wrote: post #130
Thorrez wrote: post #124

Earlier quoted context omitted.

If I operate a website, I might have some confidence that my key hasn't been stolen in the last year. But I might have much less confidence that my key hasn't been stolen in the last 20 years. Certificate expiration means I don't need to worry about that second case.

That’s only true if your key is regenerated each time you request an updated certificate. This is not mandatory, and there are lots of guides on the internet for generating a csr from an existing key.

Sure but I don't think that's generally done or recommended. I think people only do that if they have certificate pinning, which on the web is pretty rare and getting rarer as browsers drop support for HPKP.

Re: CA Root expired on 30 May 2020

#135

Post by amaccuish »

Sebb767 wrote: post #96
kl4m wrote: post #77

Earlier quoted context omitted.

Good old "cert replaced but apache/nginx failed to reload" has bitten me more than once...

Me too! Especially with the short expiration times of LetsEncrypt. But I really don't want to put `nginx -s reload` in the Cron, in case I'm tinkering with the configs and they're suddenly live (which only really happens at staging or at home of course, but still).

Certbot has deploy hooks which is where I'd put the nginx reload statement. The hooks are run automatically when a new certificate is issued.

Re: CA Root expired on 30 May 2020

#136

Post by pornel »

user5994461 wrote: post #46
josephcsible wrote: post #40

Earlier quoted context omitted.

IMO, there's a bit of a design flaw with curl here. There should be an easy flag to say "trust the particular certificate with this hash, no matter what's wrong with it", but there isn't, so people instead use the one that says "trust whatever certificate you get, no matter what's wrong with it".

Trusting a specific hash would blow up when the service rotate its self-signed certificate, defeating the point of ignoring certificate error.

If your clients support "rotating" self-signed certs just like that, it's a huge MITM vulnerability and makes HTTPS as secure as a TSA checkpoint.

Re: CA Root expired on 30 May 2020

#137

Post by Avamander »

josephcsible wrote: post #95
elcomet wrote: post #80

Earlier quoted context omitted.

What if your CA is down for a day? Imagine let's encrypt being down for 24 hours and all if it's certificates going invalid. That would be millions of websites unavailable..

This is no different than an OCSP server going down for a day. Either the site becomes unreachable, or clients take a risk by accepting a certificate that might be revoked.

When OCSP is down nothing happens with most browsers. Except-Staple might worsen it a bit, but how many use that?

Re: CA Root expired on 30 May 2020

#138

Post by josephcsible »

Avamander wrote: post #137
josephcsible wrote: post #95

Earlier quoted context omitted.

This is no different than an OCSP server going down for a day. Either the site becomes unreachable, or clients take a risk by accepting a certificate that might be revoked.

When OCSP is down nothing happens with most browsers. Except-Staple might worsen it a bit, but how many use that?

My point is that connecting with OCSP down carries the exact same risk that accepting an expired certificate does. In both cases, the risk is that the certificate might have been revoked without you knowing it.

Re: CA Root expired on 30 May 2020

#139

Post by kjaftaedi »

hombre_fatal wrote: post #92
kjaftaedi wrote: post #90

Earlier quoted context omitted.

"Middle of the afternoon" .. for who?

If you're going to ask a question about someone's comment, at least finish reading the sentence to make sure it's not immediately answered. Don't be part of the death of internet discourse.

I read the comment several times.

I am just of the opinion that "make it expire in the afternoon" doesn't apply to root certificates that are used across the entire world (i.e. - the topic of discussion)

Re: CA Root expired on 30 May 2020

#140

Post by aarbor989 »

We had to get an entirely new certificate to resolve this. We had recently migrated our docker images to be based on Amazon Linux 2, and low a behold, there was no easy way we found to upgrade to the required version of OpenSSL on Amazon Linux 2. Was easier to just upgrade our certificates
Post reply on HN