41–50 of 69 posts
Earlier quoted context omitted.
I solve this by certificate expiration monitoring and renewing the certificate at the 60 day mark. The expiration warning is configured so that it starts to yell at me if it passes that timeframe. That gives me plenty of time to fix it IF it goes wrong.
And how do you ensure your monitoring keeps working?
Aaaand it's still not fixed. I think this just goes to show how much red tape there is around processes at Microsoft.
We updated the certificate about an hour before this post. It takes 6 - 8 hours for the certificate to fully propagate.
If only there was a cloud based solution by a large company for managing certificates automatically! (Azure Front Door)
Earlier quoted context omitted.
What? 2 seconds? That sounds crazy. It either breaks ongoing connections or wastes addresses since you would have to keep your old one until all connections are closed.
It probably wasn't really "issuing a new IP address" per se, but rather CGNAT, where your apparent IP from the perspective of an IP reflector would be the IP of whichever NAT gateway your outgoing connection had been round-robin-load-balanced onto. Under CGNAT, you don't really have any single public IP; or rather, in another sense, you (and 100k other people) "have" all N public IPs at once — just like devices on a…
Earlier quoted context omitted.
DV is not the only kind of certificates validation. I don't want to have to go through the OV/EV validation process several times a year, nor to validate 4 certificate issuances a year in advance. But if I wanted to, I can do so even now without being forced - request new certificate during it's validity period, and revoke the former one.
DV is the only kind that actually matters. Browsers do not display EV certificates in the address bar anymore, the verified identity is hidden in a panel or sometimes even invisible. If you want to pay extra for snake oil, you get to enjoy all the pain in the process. See also: https://www.troyhunt.com/how-everything-were-told-about-webs...
Earlier quoted context omitted.
DV is the only kind that actually matters. Browsers do not display EV certificates in the address bar anymore, the verified identity is hidden in a panel or sometimes even invisible. If you want to pay extra for snake oil, you get to enjoy all the pain in the process. See also: https://www.troyhunt.com/how-everything-were-told-about-webs...
Google made quite a few questionable changes in Chrome (with the rest feeling forced to follow the fashion set by Chrome) and not displaying EV info. Many big organisations use tens of domain some of which look very suspicious. Information in a EV/OV cert is often the only way to establish that a domain operated by the legitimate company (and not by a phisher who registered a similarly looking domain).
The only upside of EV certificates is that the PKI companies can seek a higher rent.
Earlier quoted context omitted.
The maximum expiration time is now down to 13 months, for certs that need to be valid in a browser. And if you want to cycle yours more frequently, you can. But there's enough places that can't set up automated processes that trying to make it 90 days for everyone would be a lot of pain and a lot of broken sites.
> But there's enough places that can't set up automated processes Why can't they be automated? And anyway, this is the exact problem that short expiration times avoid! Systems that aren't set up for automation, and rely on someone once a year remembering some creaky, error prone process to get a new cert. Much better to force short expiration times so manual cert renewal is a thing of the past.
Shorter expiration times just mean they send me an email with the new .pfx every 4 months instead of every 12.
And hilariously thinking Microsoft would spin up a critical incident team for a free open-source product. I'm rolling on the floor laughing.
I think the default certificate expiration time (2 years) is a terrible idea. Its long enough that there's a good chance whoever registered the cert last time has left the team or the company. Its long enough that I've forgotten how to generate a certificate with openssl on the command line. And its long enough that each time, I (and everyone else) can justify not bothering to automate the process. But 2 years is sti…
Advantage of certbot: a systemd timer that runs every other week is very easy to write, because "certbot renew" doesn't need any user interactions. So it's literally < 10 lines of systemd unit file to automate it.
Earlier quoted context omitted.
I solve this by certificate expiration monitoring and renewing the certificate at the 60 day mark. The expiration warning is configured so that it starts to yell at me if it passes that timeframe. That gives me plenty of time to fix it IF it goes wrong.
And how do you ensure your monitoring keeps working?