8 ms·
Cisco devices must regenerate self-signed certificates before 2020
- black_puppydog 7y ago> Self-signed X.509 PKI certificates (SSC) that were generated on devices that run affected Cisco IOS® or Cisco IOS XE software releases expire on 2020-01-01 00:00:00 UTC. New self-signed certificates cannot be created on affected devices after 2020-01-01 00:00:00 UTC. Any service that relies on these self-signed certificates to establish or terminate a secure connection might not work after the certificate expires.
- wyxuan 7y agoCorrect me if I’m wrong, but is this just another measure by Cisco to block off the second hand market for the equipment?
- oarsinsync 7y agoDoubtful. Cisco software code quality isn't the best, even in their specialist fields (see the number of BGP related bugs that are patched every year, still). This looks like just another stupid bug that has already been fixed in a future release.
- tialaramex 7y agoYup. They have lots of smart people, but something has been badly wrong on the code quality front for decades. I remember not long after the turn of the century doing inter-continental live debug sessions with their team because the multicast IPv6 acceleration (MLD snooping, like IGMP snooping but for IPv6) they'd shipped was completely broken in our Catalyst 3750s. As usual the authorised workaround was to disable acceleration, destroying the value added by Cisco's incredibly expensive product so I was on Transatlantic conference calls after hours trying to get them to reproduce the issue so they could actually ship us a fix.
- olyjohn 7y agoMy theory is that the business is more focused on getting contracts and sales, and getting in some useless magic quadrant than they are on actually providing a quality product.
- mcpherrinm 7y agoYou can just get a cert (from your corporate CA, or a public one, or just some one you spin up for the purpose) to fix this issue. It's very likely just somebody harcoded a date "in the distant future" in some OpenSSL config file or script that generates the self-signed cert.
- jlgaddis 7y agoCare to explain how you think this issue is even remotely related to the grey market for Cisco products? I'm having trouble trying to come up with any link between the two. --- In my opinion, with the exception of perhaps very small networks, no one who's "doing it right" should really be affected by this issue. I can kinda maybe understand folks using self-signed certificates for VPNs but, really, if you're doing much at all with certificates you should either be running your own internal PKI and/or getting certificates by somewhere else. My previous employer had literally hundreds of devices using their own self-signed certificates (for device management) on them. Many of them were the "default" certificates that shipped on the devices, so it was the same certificate shared across hundreds of devices. As someone who gives a shit about security, that drove me absolutely nuts but no one else gave a damn. (Even worse, since nearly all of these devices used the same credentials, you'd only need to MITM one of them in order to "pwn" damn near everything on the entire network!)
- yardstick 7y agoIgnoring for a moment the fact that they hard coded an expiration date: This serves as a good reminder of why it’s a bad idea to set expiration dates at the end of a year, where lots of people are on leave for the holidays (this notice came out only 2 days ago). Instead try sometime less complicated, like mid March or Sept.
- black_puppydog 7y agoI think if someone lacks the awareness that hard-coding expiration dates is not a good idea, expecting them to think to this level is a bit much... :|
- eddieroger 7y agoIt's a good reminder nonetheless. I was on a team responsible for a web server farm and we noticed after a few years that the expiration date kept creeping closer to January since we would regularly kick off the process a few weeks before it actually expired, and decided one year to renew twice just to reset the clock away from January.
- raxxorrax 7y agox.509 certs all have a validity period. Of course they could have set them to 2099, but as far as I know you cannot change the validity without reissuing the cert.
- deleted 7y ago[deleted]
- tialaramex 7y agoIt's called notAfter and since it's part of the signed document you cannot change it without invalidating the signature. In a custom system the issuer could (but probably shouldn't) sign a document which is identical save for the notAfter date, but in the Web PKI this would be a serious miss-issuance and have consequences. By convention the notAfter field is filled out in Zulu timezone (ie UTC) and so these will expire simultaneously around the world.
- mavhc 7y agoThe certificates on the Cisco WLC only lasted 10 years, you have to upgrade the WLC and all the access points to a new version that includes a command to turn off the certificate check. If you want to upgrade an AP after that date you need to set back the clock first, so much fun
- phicoh 7y agoWhat I find bizarre is software that accepts a self-signed certificate only to then reject the cert because it has expired. What security problem are they trying to solve there?
- saurik 7y agoThe reason to expiration dates on certificates is so that a compromised private key has a limited lifetime of applicability, under an assumption that you will be actively rotating keys and issuing new certificates that expire at later points in time. As far as I would think this consideration has nothing at all to do with whether the certificate is self-signed.
- phicoh 7y agoThe model in most software that allows self-signed certs is that you eiter disable checking all together, or that the user accepts a specific cert. If you disable checking all together, then an attacker doesn't need to compromise a private key. Any impersonation attack will just work. If you require the user to accept a specific cert (and store that information) then you can just as well let the user accept an expired cert. The current situation just creates a lot of hassle for people without any security benefit. Key rotation is completely separate from the lifetime of a cert. You can renew certs while keeping keys constant forever. In practice, if your key gets compromised and you have to wait for the cert to expire, then you have a very big problem. Even with letsencrypt it is likely more than a month before the cert expires.
- AnIdiotOnTheNet 7y ago> The current situation just creates a lot of hassle for people without any security benefit. In my experience, many "security" people see this as the purpose of their job.
- mrspuratic 7y agoAlso keeps CRLs as short as possible.
- 7y ago
- jodrellblank 7y agoI'm surprised there's no workaround "set the clock back to 2019, generate a certificate, then fix the clock time". Would that not work?
- NohatCoder 7y agoThe generated certificate would also expire in 2020, so it would be invalid immediately.
- loriverkutya 7y agoI still remember the time when 1st of January 2020 was so far in the future that it seemed it will never happen.
- croon 7y agoI've been booking meetings for 2020 and it still looks weird.
- jcadam 7y agoIt's probably going to take me about 2 months after the new year stop writing/entering "2019" on forms. And checks. And anything else that calls for a date. Pretty much the same thing happens to me every year.
- rocqua 7y agoI recently decided to switched to a 36 hour week. I accidentally said I wanted the switch to start on January first 2019 rather than 2020... Things seem to have been fixed, but it was a scary mistake to make.
- iforgotpassword 7y agoI did data recovery on an external drive in 2011. It was pretty bad but I only needed a dozen files or so, rest was backed up. One of the files restored had a borked creation time in May 2020. For some reason I never fixed that, so whenever I accessed that folder and sort by date, that file would be at the top. This is will stop happening soon. I grew so fond of this quirk that I'm almost sad.
- exikyut 7y agotouch -d 'Jan 01 2030' I initially thought 2099 but 2030 lets you poke it again in ten years :>
- empath75 7y agohttps://en.m.wikipedia.org/wiki/Cyberpunk_2020 https://en.m.wikipedia.org/wiki/Cyberpunk_2020
- rb808 7y agoCertificate management is such a huge problem for big organizations. Does anyone have guidelines on how to do it properly? You really need a way to track who is using what and how they automatically get renewed a long time before expiry. My view now is that certificates should be renewed very often - like every month, if you see something within 6 months of expiry there is a problem.
- tyingq 7y agoThere is software like Venifi, but it requires everyone to follow a specific process. You still have outliers.
- Znafon 7y agoYou can use something like Vault with the PKI backend and an audit engine set up. You will get a full trace of all certs delivered and an API endpoint to update them.
- rb808 7y agohttps://www.vaultproject.io/docs/secrets/pki/index.html https://www.vaultproject.io/docs/secrets/pki/index.html thanks
- hylaride 7y agoI'd like to know as well. At my work we had to partner with a major bank and they demanded a fully signed (sigh) client certificate for the integration. The way their API works means that we have to do a planned hard-cutover before the certificate expires. There's a 60% chance that we'll have trouble reaching out to the right people when the time comes. Ugh.
- uxp 7y agoThis is a common problem in healthcare insurance. API connections will stop working for about 3 weeks every year as each side performs a complicated dance of noticing the expiration and updating the systems to accept a new public certificate.
- tyingq 7y agoThey seem to be highlighting SIP/VOIP as the main issue. And downplaying ssh access into the router based on an assumption that most don't use x509 certs for ssh. Does that sound right?
- allset_ 7y agoMost SSH access doesn't use x.509, so yes that sounds right.
- jlgaddis 7y agoYes, most don't use X.509 for SSH (note: public key authentication is not the same thing).
- tialaramex 7y agoAlso, you aren't affected if you actually have a CA. This only blows up if you use the Cisco device's own self-signed certs which it always mints (in affected versions of IOS) with notAfter 2020-01-01. For stuff like web tools that might happen by least effort, but for SSH it's a bunch of extra effort, 90% of the effort of doing it properly, yet with almost none of the security benefits. Anybody who cares will use their own CA and be unaffected, anybody who doesn't care never enabled certs for SSH on the Cisco boxes.
- TrueDuality 7y agoOh god. Thanks Cisco for dropping this 11 days before the end of the year. Wooo, glad I saw it here at least...
- EncryptEntropy 7y agoJust had to emergency deal with this issue within a large scale complex ISP env. Fun times! Edit: And yes as others pointed out, right into the day or two before holiday moratorium.
- egberts 7y agoWith the multiple-evocation of OpenSSL needed to create the 23-odd types of PKI certificates, I've banged out a bash-based front-end tool to OpenSSL to simplify things. Hope it helps. https://github.com/egberts/tls-ca-manage https://github.com/egberts/tls-ca-manage