141–150 of 166 posts
Everyone loves to say they work at $FAMOUS_COMPANY, but when something like this happens, no-one will say that they did this. Looking forward to the post-mortem.
Oh I am more than happy to tell people how I took down entire Google Cloud 11 years ago. I mean, of course to the level of details Google is comfortable with to share externally :)
Earlier quoted context omitted.
In theory 8 hours of downtime should be fine for a CA. Obviously not ideal, but the pki system is not meant to be a live system.
Fairly sure it used to be pretty much a manual process where someone had to actually process your request for a certificate on the other side.
For code signing certificates and EV certificates, (and OV certificates, if they are even alive), this is still the case.
Earlier quoted context omitted.
Delete a decryption key. Good luck! I'll see you at the end of time. Break your control plane, and you can't stop the propagation of poison. Propagate the wrong trust bundle... everywhere. Also, it's not about the delete command. It's about the automatic cleanup following behind it that shreds everything, or repurposes the storage.
Children of the kubernetic line.
Earlier quoted context omitted.
What qualifies as a non-compliant certificate?
It doesn't comply with one or more root store policies (which all incorporate the Baseline Requirements by reference, which incorporate various specs, such as RFC5280, by reference). Mozilla root store policy: https://www.mozilla.org/en-US/about/governance/policies/secu... Chrome root store policy: https://googlechrome.github.io/chromerootprogram/ Apple root store policy: https://www.apple.com/certificateauthority/ca…
People went ballistic on me a few months ago for bringing this up, but this is exactly the kind of outage that makes me really, really worried about extremely short lived certificates. https://news.ycombinator.com/item?id=46118371
Your license to website has been revoked.
Effectively certificates are now a license to publish.
Earlier quoted context omitted.
It doesn't comply with one or more root store policies (which all incorporate the Baseline Requirements by reference, which incorporate various specs, such as RFC5280, by reference). Mozilla root store policy: https://www.mozilla.org/en-US/about/governance/policies/secu... Chrome root store policy: https://googlechrome.github.io/chromerootprogram/ Apple root store policy: https://www.apple.com/certificateauthority/ca…
Something is badly borked when the protections against an imaginary problem cause a real problem.
There are countless Bugzilla reports of clearly unprofessional CAs trying to get away with doing whatever they want, get caught, say "it's no big deal", fail to learn the lesson and eventually get kicked out, much to the chagrin and bewilderment of their management, irate that some nerds on the Internet could ruin their business, failing to understand that following the scripture of the Internet nerds is the #1 requirement of the business they chose to run.
Earlier quoted context omitted.
Your license to website has been revoked.
You're joking, but still: that's one very possible outcome of both requiring centrally issued certificates for security reasons and browsers refusing to display websites without. Effectively certificates are now a license to publish.
On mobile, user certs are pretty much ignored unless opted in by apps. Even firefox allows user certs (for now) but only via an obscure hidden config.
This means we cannot use self-hosted services even using a VPN with official apps without getting a signed cert.