Looks like they tried to rotate the cert, maybe due to the private key leak. But instead, they rolled the wrong expired key to all content domains.
I'm more thinking the new host key prevented SSL cert rotation from happening properly
Expired SSL Certificate at GitHub
21–30 of 33 posts
Re: Expired SSL Certificate at GitHub
#22[deleted]
Re: Expired SSL Certificate at GitHub
#23Looks like they tried to rotate the cert, maybe due to the private key leak. But instead, they rolled the wrong expired key to all content domains.
I'm more thinking the new host key prevented SSL cert rotation from happening properly
Maybe, but only if they're refreshing certificates less than a day before expiry. Which isn't ideal.
Re: Expired SSL Certificate at GitHub
#24Guess this will never stop happening
…and with more frequency in the future. 90 day certs are going to make it happen all the more often.
Re: Expired SSL Certificate at GitHub
#25Earlier quoted context omitted.
Whomst among us hasn't made the old "accidentally let the SSL cert expire" mistake?
Caddy and the auto-issuing certs is the next step, but that is prone to failure, too, of a different kind.
Automated certificate issuing is a problem by itself. "The authority that issued my cert isn't the authority that I thought it was but it looks the same and works, so carry on" kind of thing.
Re: Expired SSL Certificate at GitHub
#26They're serving the wrong cert on pkg-containers.githubusercontent.com (it's for *.githubassets.com) and their support site also expired 3/21... https://support.github.com/ What is going on over there?
Layoffs?
Re: Expired SSL Certificate at GitHub
#27Re: Expired SSL Certificate at GitHub
#28I built a free monitoring service some years ago if anyone doesn't want to be the victim of this...
https://ismycertexpired.com/check?domain=objects.githubuserc...
Re: Expired SSL Certificate at GitHub
#29How is it that literally nobody – whether deploying a hobby project or working at Microsoft or Google – has ever been able to figure out cert rotation? There's a billion dollar company waiting to be built if someone can just ensure that all my TLS certs across all servers will stay up to date for all eternity.