11 ms·

This has happened to me enough times to be embarrassing. It seems to happen to other people who you'd think have some sensible way to avoid it. Is there a remi

This has happened to me enough times to be embarrassing. It seems to happen to other people who you'd think have some sensible way to avoid it. Is there a reminder service out there that specializes in your long-term expiring things? I'm not sure what would be different about it than a regular calendar, but it seems like many of us need something that makes this easier.

STRML 7y ago
Yeah, Cert Spotter does this (https://sslmate.com/certspotter/ https://sslmate.com/certspotter/). It's a huge help both to be able to monitor cert issuance for a domain and all of its subs, and to be reminded when a cert is expiring.
snarfy 7y ago
It wouldn't be different than a regular calendar. It would be nice if they prompted you to 'add to calendar' when you are creating certs.
- inetknght 7y ago
  > It would be nice if they prompted you to 'add to calendar' when you are creating certs. That would actually be a really _awesome_ integration of ACME client software with CalDAV [0] and other ticketing software APIs like Jira: set up calendar events and/or tickets with increasing priority to verify that the certificate is updated. [0]: https://en.wikipedia.org/wiki/CalDAV https://en.wikipedia.org/wiki/CalDAV
Someone1234 7y ago
There are multiple reminder services. At larger companies a lot of the issue isn't literally generating reminders, it is making sure they're sent to the correct people/departments and are actioned by anyone. For example you sometimes have reminders sent to ex-employees, or sent to a mailing list and everyone assuming everyone else is going to action it. Or the reminder gets ping-ponged between multiple managers via email with nobody either able or willing to deal with it. None of these are tech' issues, and they don't have technology solutions as a consequence. So whenever I see an embarrassing expired cert, I don't assume technical malfunction, I assume political malfunction.
- jalk 7y ago
  I guess they should send the reminders to the Slack channel that the ms ops team uses ;-)
  - outworlder 7y ago
    Yup. And hope that the channel is not being similarly used for many other things and generating alert fatigue.
- deleted 7y ago
  [deleted]
overcast 7y ago
I mean our cert provider literally emails us daily for months about pending expiration. Otherwise put it in your own calendar?
remus 7y ago
It's a pretty simple little python script, though obviously you then run the risk that it's no longer running in x years time when you actually need it. import ssl import OpenSSL from datetime import datetime cert = ssl.get_server_certificate((www.google.com, 443)) x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, cert) expiry_dt = datetime.strptime(x509.get_notAfter()[:8].decode('utf-8'), '%Y%m%d')
- jimktrains2 7y ago
  Does ssl.get_server_certificate handle sni? Also, no need for python: echo | openssl s_client -connect google.com:443 -servername google.com -showcerts 2>&1 | openssl x509 -text -noout | grep "Not After" | cut -d : -f 2- | xargs -I {} date -d "{}" +%Y%m%d
  - Arnavion 7y ago
    `-text -noout | grep "Not After"` is just `-enddate -noout`
notatoad 7y ago
I feel like once is enough times for it to be embarrasing, but this is at least the second time it's happened to Microsoft, which is just crazy.
kawsper 7y ago
We use a daily Ruby script that puts data into InfluxDB and we use Grafana to warn us if a certificate is close to expire: tcp_client = TCPSocket.new(domain, 443) ssl_client = OpenSSL::SSL::SSLSocket.new(tcp_client) ssl_client.hostname = domain ssl_client.connect cert = OpenSSL::X509::Certificate.new(ssl_client.peer_cert) ssl_client.sysclose tcp_client.close certprops = OpenSSL::X509::Name.new(cert.issuer).to_a issuer = certprops.select { |name, data, type| name == "O" }.first[1] results = { valid_on: cert.not_before.utc, valid_until: cert.not_after.utc, issuer: issuer, days_left: (cert.not_after.utc - Time.now.utc).to_i / (24 * 60 * 60), }
benburleson 7y ago
This also happened recently to one of our clients that refuses to allow us to manage their cert... I guess there is a market for a reminder service.
zedpm 7y ago
If you use Nagios for monitoring, you can use the check_http plugin for this, e.g. check_http -H <hostname> -C 30,14. That will return a warning status if the cert expires within 30 days and return a critical status if the cert expires within 14 days.
- GuyPostington 7y ago
  Something similar exists for Sensu too https://github.com/sensu-plugins/sensu-plugins-http/blob/master/bin/check-https-cert.rb https://github.com/sensu-plugins/sensu-plugins-http/blob/mas...
dontbenebby 7y ago
They said they're doing a post-mortem, but how much can a public post mortem really say about "forgot to renew a thing"? I appreciate the sentiment but I think it's fine for them to just say "we examined our processes, found out what led to the issue, and have modified procedures". I worry a detailed post mortem would just throw specific folks under the bus (most likely some low level employee who isn't actually the root cause)
weddpros 7y ago
https://sslping.com https://sslping.com if free, simple and it checks your TLS settings too
- tramtrist 7y ago
  I got a perfect rating :) Thank you very much!!

STRML 7y ago

Yeah, Cert Spotter does this (https://sslmate.com/certspotter/ https://sslmate.com/certspotter/). It's a huge help both to be able to monitor cert issuance for a domain and all of its subs, and to be reminded when a cert is expiring.

snarfy 7y ago

It wouldn't be different than a regular calendar. It would be nice if they prompted you to 'add to calendar' when you are creating certs.

inetknght 7y ago
> It would be nice if they prompted you to 'add to calendar' when you are creating certs. That would actually be a really _awesome_ integration of ACME client software with CalDAV [0] and other ticketing software APIs like Jira: set up calendar events and/or tickets with increasing priority to verify that the certificate is updated. [0]: https://en.wikipedia.org/wiki/CalDAV https://en.wikipedia.org/wiki/CalDAV

Someone1234 7y ago

There are multiple reminder services. At larger companies a lot of the issue isn't literally generating reminders, it is making sure they're sent to the correct people/departments and are actioned by anyone. For example you sometimes have reminders sent to ex-employees, or sent to a mailing list and everyone assuming everyone else is going to action it. Or the reminder gets ping-ponged between multiple managers via email with nobody either able or willing to deal with it. None of these are tech' issues, and they don't have technology solutions as a consequence. So whenever I see an embarrassing expired cert, I don't assume technical malfunction, I assume political malfunction.

jalk 7y ago
I guess they should send the reminders to the Slack channel that the ms ops team uses ;-)
- outworlder 7y ago
  Yup. And hope that the channel is not being similarly used for many other things and generating alert fatigue.
deleted 7y ago
[deleted]

overcast 7y ago

I mean our cert provider literally emails us daily for months about pending expiration. Otherwise put it in your own calendar?

remus 7y ago

It's a pretty simple little python script, though obviously you then run the risk that it's no longer running in x years time when you actually need it. import ssl import OpenSSL from datetime import datetime cert = ssl.get_server_certificate((www.google.com, 443)) x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, cert) expiry_dt = datetime.strptime(x509.get_notAfter()[:8].decode('utf-8'), '%Y%m%d')

jimktrains2 7y ago
Does ssl.get_server_certificate handle sni? Also, no need for python: echo | openssl s_client -connect google.com:443 -servername google.com -showcerts 2>&1 | openssl x509 -text -noout | grep "Not After" | cut -d : -f 2- | xargs -I {} date -d "{}" +%Y%m%d
- Arnavion 7y ago
  `-text -noout | grep "Not After"` is just `-enddate -noout`

notatoad 7y ago

I feel like once is enough times for it to be embarrasing, but this is at least the second time it's happened to Microsoft, which is just crazy.

kawsper 7y ago

We use a daily Ruby script that puts data into InfluxDB and we use Grafana to warn us if a certificate is close to expire: tcp_client = TCPSocket.new(domain, 443) ssl_client = OpenSSL::SSL::SSLSocket.new(tcp_client) ssl_client.hostname = domain ssl_client.connect cert = OpenSSL::X509::Certificate.new(ssl_client.peer_cert) ssl_client.sysclose tcp_client.close certprops = OpenSSL::X509::Name.new(cert.issuer).to_a issuer = certprops.select { |name, data, type| name == "O" }.first[1] results = { valid_on: cert.not_before.utc, valid_until: cert.not_after.utc, issuer: issuer, days_left: (cert.not_after.utc - Time.now.utc).to_i / (24 * 60 * 60), }

benburleson 7y ago

This also happened recently to one of our clients that refuses to allow us to manage their cert... I guess there is a market for a reminder service.

zedpm 7y ago

If you use Nagios for monitoring, you can use the check_http plugin for this, e.g. check_http -H <hostname> -C 30,14. That will return a warning status if the cert expires within 30 days and return a critical status if the cert expires within 14 days.

GuyPostington 7y ago
Something similar exists for Sensu too https://github.com/sensu-plugins/sensu-plugins-http/blob/master/bin/check-https-cert.rb https://github.com/sensu-plugins/sensu-plugins-http/blob/mas...

dontbenebby 7y ago

They said they're doing a post-mortem, but how much can a public post mortem really say about "forgot to renew a thing"? I appreciate the sentiment but I think it's fine for them to just say "we examined our processes, found out what led to the issue, and have modified procedures". I worry a detailed post mortem would just throw specific folks under the bus (most likely some low level employee who isn't actually the root cause)

weddpros 7y ago

https://sslping.com https://sslping.com if free, simple and it checks your TLS settings too

tramtrist 7y ago
I got a perfect rating :) Thank you very much!!