Surely the current CA paradigm shouldn't continue to be accepted by the people who keep infrastructure running anymore?
We need to do something.
CA Root expired on 30 May 2020
21–30 of 154 posts
Re: CA Root expired on 30 May 2020
#22Stripe Webhooks are currently failing "for some users" https://twitter.com/stripestatus/status/1266756286734938116 -- some chance that's related.
Edit: for https://www.circuitlab.com/ we saw all Stripe webhooks failing from 4:08am through 12:04pm PDT today with "TLS error". Since 12:04pm (5 minutes ago), some webhooks are succeeding and others are still failing.
Edit 2: since 12:17pm all webhooks are succeeding again. Thanks Stripe!
Re: CA Root expired on 30 May 2020
#23Quick reminder from your friendly local SRE: never ever issue certificates that expire on weekends. Make certs expire in the middle of the afternoon on a business day wherever your operators live and work. The cert in question expires at May 30 10:48:38 2020 GMT, which smells suspiciously like a fixed time after the cert was generated, rather than at a well-chosen point in time.
Great tip. Did you notice that cert in this case was issued 20 years ago? It’s crazy to me that it was still being used to sign certs as recently as last week (according to twitter)
Re: CA Root expired on 30 May 2020
#24Some users on Safari (probably old versions) appear to be getting bad cert warnings for https://www.playsaurus.com . REALLY glad I found this post here, it was driving me nuts.
FWIW I'm getting cert errors on that site on the latest chrome.
I don't. Isn't chrome using the systems CA store and encryption infrastructure if possible? At least on Windows it's using Windows' built-in certs.
Re: CA Root expired on 30 May 2020
#25ip-api.com was also affected by this.
After our first alert at 10:49 (cert expired at 10:48:38) and a minute of being puzzled as to why our certificate expired, we realized the root we bundled is the issue. We finished updating our primary API servers at 10:55.
Re: CA Root expired on 30 May 2020
#26Quick reminder from your friendly local SRE: never ever issue certificates that expire on weekends. Make certs expire in the middle of the afternoon on a business day wherever your operators live and work. The cert in question expires at May 30 10:48:38 2020 GMT, which smells suspiciously like a fixed time after the cert was generated, rather than at a well-chosen point in time.
Great tip. Did you notice that cert in this case was issued 20 years ago? It’s crazy to me that it was still being used to sign certs as recently as last week (according to twitter)
Of course, but that doesn't really excuse them. My first experience with middle-of-Sunday-night SSL certificate expiration was in December 1998, and it was already a well-known doctrine by then. I'd expect a commercial certificate authority to have these kinds of things squared away.
Re: CA Root expired on 30 May 2020
#27Quick reminder from your friendly local SRE: never ever issue certificates that expire on weekends. Make certs expire in the middle of the afternoon on a business day wherever your operators live and work. The cert in question expires at May 30 10:48:38 2020 GMT, which smells suspiciously like a fixed time after the cert was generated, rather than at a well-chosen point in time.
If you get to the point where the exact expiration date on the certificate matters, you've already lost the game.
Re: CA Root expired on 30 May 2020
#28Honestly, certificates should never expire or should expire daily. If certificate revocation works then its pointless to have expiring certs. Its just a mechanism for CAs to seek rent.
If certificate revocation doesnt work then certs need to expire super frequently to limit potential damage if compromised.
A certificate that expires in 20 years does absolutely nothing for security compared to a certificate that never expires. Odds are that in 20 years the crypto will need to be updated anyways, effectively revoking the certificate.
Re: CA Root expired on 30 May 2020
#29Site24x7's ssl monitor caught this for us yesterday. And i thought they were wrong as we purchased this last certificate just a few months back.
Re: CA Root expired on 30 May 2020
#30I have never really wanted to go "serverless" until today. TIL that I can buy a cert that expires in a year that is signed by a root certificate that expires sooner. Still not sure WHY this is the case, but this is definitely the case.
Because the certificate authority paradigm is LITERALLY INSANE.