Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Expired SSL certificate

manjaro.github.io

Post reply on HN
Print view View original

31–40 of 71 posts

Re: Expired SSL certificate

#31

Post by userbinator »

billpg wrote: post #7

I wonder if browsers should for (say) a week after a cert has expired, show an error so alarms are raised, but allow the dialog to be dismissed with an OK instead of all the "Confirm Security Exception" that would go on for a more serious cert rejection.

I think the real problem is that, by assuming users won't read error messages carefully, and making them shorter/less informative as a result, we've been implicitly encouraging this behaviour, leading to even less attention paid to the messages, etc. and the vicious cycle continues.

The original argument was that seeing error messages often will make users ignore them, but I don't think certificate errors should be very common now. Either way, I think we should be encouraging users to read error messages more carefully. Maybe the Yes/No buttons on the dialog should be put in a random order, and the question randomly flips between "Do you want to proceed?" and "Do you want to abort?"... adding a "learn more" option would be a good idea too.

Re: Expired SSL certificate

#33

Post by Piskvorrr »

billpg wrote: post #18
ins0 wrote: post #9

Earlier quoted context omitted.

That is by far not the job of a browser to remind server administrators to renew there certs and display that message to random users.

Alas, in this imperfect world, phone calls from random users are how server admins are notified of cert expiry.

...where a 10-line cron script would have done the same job, in advance.

Re: Expired SSL certificate

#34

Post by billpg »

HendrikR wrote: post #32

This is really awesome. Why do certificates expire in the first place?

By having an expiry, revoked certs can be forgotten about once the expiry has passed. We'd need to keep a forever growing list of revocations otherwise.

Re: Expired SSL certificate

#35

Post by legulere »

billpg wrote: post #34
HendrikR wrote: post #32

This is really awesome. Why do certificates expire in the first place?

By having an expiry, revoked certs can be forgotten about once the expiry has passed. We'd need to keep a forever growing list of revocations otherwise.

Also certs get switched to ones with stronger algorithms and longer keylengths after expiry. You also would have to revoke old certs all the time when their crypto isn't safe anymore.

Re: Expired SSL certificate

#37

Post by IgorPartola »

vacri wrote: post #26
josephmx wrote: post #22

Earlier quoted context omitted.

Checking their about page, they have 3 web developers, one of which wrote that post. That's worrying.

The available web developers may not have access to either the SSL vendor or where the certificate is stored. None of the front-end devs I work with have access to either of those things.

The first problem is solved by getting a new vendor. The second, well someone has to have access to that.

Re: Expired SSL certificate

#38

Post by IgorPartola »

jng wrote: post #5

What is shocking is that they still haven't found the way to properly fix it after 3 days. I updated some SSL certificates last week (which even required contortions such as moving to a new issuer since some legacy software requires old-style SHA-1 signed ones which our current one doesn't provide), and it didn't take more than one (long) day of work.

At this point, changing out a cert takes me about 15 minutes (typically for multiple servers). 10 of those is figuring out the order in which to include intermediate certs. I really should script that part out.
Post reply on HN