Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Even Akamai screws up their SSL certs

akamai.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: Even Akamai screws up their SSL certs

#31

Post by Shish2k »

bgwhn wrote: post #5
agwa wrote: post #2

Actually, they probably don't intend for people to use www.akamai.com with HTTPS. If you add an override for the bad cert, you end up getting redirected to a non-HTTPS site anyways. I don't see anything like a login link on www.akamai.com so this is probably OK. (Of course it would be nice if everything were HTTPS...)

> Of course it would be nice if everything were HTTPS... Nice try, Certificate Authorities!

It would be nice if everything were HTTPS, but the default behaviour for a self-signed cert was "accept it the first time, but don't show the lock icon or anything, and then warn if it changes" - ie self-signed HTTPS is the new HTTP

Re: Even Akamai screws up their SSL certs

#32

Post by brians »

mnordhoff wrote: post #18
patcheudor wrote: post #7

Better yet, where they absolutely mean to use HTTPS they sometimes use weak keys and ciphers and get an "F" from the Qualys SSL Labs tool. Blogs.akamai.com isn't the only place this happens: https://www.ssllabs.com/ssltest/analyze.html?d=blogs.akamai....

Not the biggest crisis. Okay, they have several awful cipher suites enabled, but no sane client would ever use them. The client report shows that almost every client uses AES; a couple crappy ones use RC4 or 3DES. They don't have PFS, either. That's bad, though unfortunately still common. As far as I know Akamai's position is that the (small) performance cost of PFS is unacceptable. They would be delighted if it was…

Indeed, it looks like that's a bug in the SSL labs rating scheme: given two trust paths, it takes the longer one.

The Baltimore root is trusted, but also signed by the old GTE 1024-bit root. It's not clear to me what harm it does to have an appendix of old roots above a well-managed, trustworthy trusted root.

Re: Even Akamai screws up their SSL certs

#33

Post by brians »

patcheudor wrote: post #17
patcheudor wrote: post #7

Better yet, where they absolutely mean to use HTTPS they sometimes use weak keys and ciphers and get an "F" from the Qualys SSL Labs tool. Blogs.akamai.com isn't the only place this happens: https://www.ssllabs.com/ssltest/analyze.html?d=blogs.akamai....

Someone's parents are going to be really mad about this report card: https://www.ssllabs.com/ssltest/analyze.html?d=developer.aka... https://www.ssllabs.com/ssltest/analyze.html?d=a248.e.akamai... https://www.ssllabs.com/ssltest/analyze.html?d=network.akama... The thing is, the worst part is knowing a child is capable of A's: https://www.ssllabs.com/ssltest/analyze.html?d=control.akama...

That's my report card.

The grades are up to Cs now and should be As within a day.

I'm glad Ivan and Qualys are helping show us where we really are.

Re: Even Akamai screws up their SSL certs

#35

Post by ivanr »

brians wrote: post #32
mnordhoff wrote: post #18

Earlier quoted context omitted.

Not the biggest crisis. Okay, they have several awful cipher suites enabled, but no sane client would ever use them. The client report shows that almost every client uses AES; a couple crappy ones use RC4 or 3DES. They don't have PFS, either. That's bad, though unfortunately still common. As far as I know Akamai's position is that the (small) performance cost of PFS is unacceptable. They would be delighted if it was…

Indeed, it looks like that's a bug in the SSL labs rating scheme: given two trust paths, it takes the longer one. The Baltimore root is trusted, but also signed by the old GTE 1024-bit root. It's not clear to me what harm it does to have an appendix of old roots above a well-managed, trustworthy trusted root.

No, the issue is not with the trust paths. The old 1024-bit root is in Mozilla's trust store, where it's a danger to everyone. SSL Labs reuses their store, which is why the weak root shows up in the trust paths.

Technically, the F for blogs.akamai.com was a bug (now corrected; the grade after the fix is C). I say "technically" not because I approve of export cipher suites, but because the implementation did not follow the documentation (the rating guide, linked from every report). Export suites are hopelessly weak and will be treated more harshly in the next guide revision. The new grade is certainly not something to be happy about.

Re: Even Akamai screws up their SSL certs

#36

Post by patcheudor »

brians wrote: post #33
patcheudor wrote: post #17

Earlier quoted context omitted.

Someone's parents are going to be really mad about this report card: https://www.ssllabs.com/ssltest/analyze.html?d=developer.aka... https://www.ssllabs.com/ssltest/analyze.html?d=a248.e.akamai... https://www.ssllabs.com/ssltest/analyze.html?d=network.akama... The thing is, the worst part is knowing a child is capable of A's: https://www.ssllabs.com/ssltest/analyze.html?d=control.akama...

That's my report card. The grades are up to Cs now and should be As within a day. I'm glad Ivan and Qualys are helping show us where we really are.

Awesome! Glad to see this getting resolved. And one more thing. We are proud of you son.
Post reply on HN