Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CA Root expired on 30 May 2020

support.sectigo.com

Post reply on HN
Print view View original

41–50 of 154 posts

Re: CA Root expired on 30 May 2020

#41

Post by techslave »

btgeekboy wrote: post #27
jeffbee wrote: post #20

Quick reminder from your friendly local SRE: never ever issue certificates that expire on weekends. Make certs expire in the middle of the afternoon on a business day wherever your operators live and work. The cert in question expires at May 30 10:48:38 2020 GMT, which smells suspiciously like a fixed time after the cert was generated, rather than at a well-chosen point in time.

If you get to the point where the exact expiration date on the certificate matters, you've already lost the game.

it’s more like blue m&m’s than an actual requirement

Re: CA Root expired on 30 May 2020

#42

Post by josephcsible »

vbezhenar wrote: post #39
admax88q wrote: post #28

Honestly, certificates should never expire or should expire daily. If certificate revocation works then its pointless to have expiring certs. Its just a mechanism for CAs to seek rent. If certificate revocation doesnt work then certs need to expire super frequently to limit potential damage if compromised. A certificate that expires in 20 years does absolutely nothing for security compared to a certificate that never…

To revoke a certificate you must keep a list of revoked certificates. Without expiration date that list would grow infinitely. And that list should be downloaded periodically by every entity which wants to verify certificate.

They said "certificates should never expire or should expire daily". Roots already can't be revoked, so they should never expire. Intermediates and leaves should expire daily. Since currently, OCSP responses are often valid for that long, there'd be no need for revocation anymore then.

Re: CA Root expired on 30 May 2020

#43

Post by LeonM »

This one bit me today and abruptly ended my day at the beach.

The certificate reseller advised my customer that it was okay to include the cross-signing cert in the chain, because browsers will automatically ignore it once it expires, and use the Comodo CA root instead.

And that was true for browsers I guess. But my customer also has about 100 machines in the field that use cURL to access their HTTPS API endpoint. cURL will throw an error if one of the certs in the chain has expired (may be dependent on the order, don't know).

Anyway, 100 machines went down and I had a stressed out customer on the phone.

Re: CA Root expired on 30 May 2020

#44

Post by user5994461 »

jeffbee wrote: post #26
encoderer wrote: post #23

Earlier quoted context omitted.

Great tip. Did you notice that cert in this case was issued 20 years ago? It’s crazy to me that it was still being used to sign certs as recently as last week (according to twitter)

Of course, but that doesn't really excuse them. My first experience with middle-of-Sunday-night SSL certificate expiration was in December 1998, and it was already a well-known doctrine by then. I'd expect a commercial certificate authority to have these kinds of things squared away.

My experience with commercial CA is that they set the expiry exactly 1 year from creation. Doesn't matter if it's a week end or a holiday.

Re: CA Root expired on 30 May 2020

#45

Post by AmericanChopper »

ta17711771 wrote: post #30
encoderer wrote: post #2

I have never really wanted to go "serverless" until today. TIL that I can buy a cert that expires in a year that is signed by a root certificate that expires sooner. Still not sure WHY this is the case, but this is definitely the case.

Because the certificate authority paradigm is LITERALLY INSANE.

It’s the PKI paradigm that creates most of the insanity. Authentication is still an unsolved issue with PKI, there’s many ways that you can perform authentication, but all of the different approaches lead to one form of insanity or another. The CA system has its share of insanity, but it is the most successful PKI implementation in history, and by a long way.

Re: CA Root expired on 30 May 2020

#46

Post by user5994461 »

josephcsible wrote: post #40
luckylion wrote: post #3

Any predictions how much the usage of CURLOPT_SSL_VERIFYPEER, false will increase in the next 7 days?

IMO, there's a bit of a design flaw with curl here. There should be an easy flag to say "trust the particular certificate with this hash, no matter what's wrong with it", but there isn't, so people instead use the one that says "trust whatever certificate you get, no matter what's wrong with it".

Trusting a specific hash would blow up when the service rotate its self-signed certificate, defeating the point of ignoring certificate error.

Re: CA Root expired on 30 May 2020

#47

Post by x3n0ph3n3 »

seibelj wrote: post #6

DataDog failed this morning because of root CA issue.[0] Was a fun Saturday morning with 5000 alarms blowing up my phone. [0] https://status.datadoghq.com/incidents/6bqpd511nj4h

Thanks for mentioning this, since it caused me to go check metrics and find they weren't coming in... Luckily only a couple of my alarms come from metrics via the agent itself.

Re: CA Root expired on 30 May 2020

#48

Post by bransonf »

Fairly certain this affected Kroger. My sister called me this morning asking to troubleshoot why her laptop was warning of an unsecured connection.

Perhaps a coincidence, but also likely that their cert expired.

Re: CA Root expired on 30 May 2020

#49

Post by 0x0 »

LeonM wrote: post #43

This one bit me today and abruptly ended my day at the beach. The certificate reseller advised my customer that it was okay to include the cross-signing cert in the chain, because browsers will automatically ignore it once it expires, and use the Comodo CA root instead. And that was true for browsers I guess. But my customer also has about 100 machines in the field that use cURL to access their HTTPS API endpoint. cU…

Sounds like a good test case for exercising those otherwise useless "million dollar insurances" that some certificate vendors flash in their sales materials?
Post reply on HN