4 ms·

Spotify hit with outage after forgetting to renew a certificate

37 points by arkadiyt 6y ago

donmcronald 6y ago
Is that certificate they bought [1] $688 [2] for the year? I've been wondering for a while if any security researchers use those overpriced certs as an indicator. Someone paying $600+ per year for an SSL certificate and forgetting to renew it is an indication they might be misunderstanding and neglecting other stuff, right? 1. https://crt.sh/?id=3263659027 https://crt.sh/?id=3263659027 2. https://www.digicert.com/wildcard-ssl-certificates/ https://www.digicert.com/wildcard-ssl-certificates/
- kingnothing 6y ago
  All companies are misunderstanding some things and neglecting other things. There's a way in to every system. The best companies hire red teams to pentest their own systems and do their best to fix the flaws, but those dedicated red teams also find a way in every single time.
- coldtea 6y ago
  >is an indication they might be misunderstanding and neglecting other stuff, right? So like all companies?
rightbyte 6y ago
Why not just have two certificates rolling with overlap for some redundancy ...
- dirtnugget 6y ago
  Some problems are only thought about when they start to hit you and I guess this is one of them.
- sukilot 6y ago
  Why not renew your certificate a year before the expiration date?
  - AceyMan 6y ago
    This begs the question: if I could remember to renew the cert 365 days before it lapsed then I could as easily remember to renew it 45 days ahead (which, operationally speaking, is as good). In any case, certificates can only be purchased for a one year term now, so your hypothetical "one year ahead" doesn't fit the problem. Even if buying any updated cert that far ahead creates the same validity period it's not the buying the cert that's the catch — it's the deployment of said cert.
magneticnorth 6y ago
I'm really glad I saw this article - I tried spotify on my work desktop browser for the first time on the 19th and when it didn't work I assumed I just wasn't able to listen to spotify through my work computer's browser. Didn't even occur to me that spotify might be having an outage. Glad to learn I can listen to spotify at work.

37 points by arkadiyt 6y ago

Is that certificate they bought [1] $688 [2] for the year? I've been wondering for a while if any security researchers use those overpriced certs as an indicator. Someone paying $600+ per year for an SSL certificate and forgetting to renew it is an indication they might be misunderstanding and neglecting other stuff, right? 1. https://crt.sh/?id=3263659027 https://crt.sh/?id=3263659027 2. https://www.digicert.com/wildcard-ssl-certificates/ https://www.digicert.com/wildcard-ssl-certificates/

kingnothing 6y ago
All companies are misunderstanding some things and neglecting other things. There's a way in to every system. The best companies hire red teams to pentest their own systems and do their best to fix the flaws, but those dedicated red teams also find a way in every single time.
coldtea 6y ago
>is an indication they might be misunderstanding and neglecting other stuff, right? So like all companies?

rightbyte 6y ago

Why not just have two certificates rolling with overlap for some redundancy ...

dirtnugget 6y ago
Some problems are only thought about when they start to hit you and I guess this is one of them.
sukilot 6y ago
Why not renew your certificate a year before the expiration date?
- AceyMan 6y ago
  This begs the question: if I could remember to renew the cert 365 days before it lapsed then I could as easily remember to renew it 45 days ahead (which, operationally speaking, is as good). In any case, certificates can only be purchased for a one year term now, so your hypothetical "one year ahead" doesn't fit the problem. Even if buying any updated cert that far ahead creates the same validity period it's not the buying the cert that's the catch — it's the deployment of said cert.

magneticnorth 6y ago

I'm really glad I saw this article - I tried spotify on my work desktop browser for the first time on the 19th and when it didn't work I assumed I just wasn't able to listen to spotify through my work computer's browser. Didn't even occur to me that spotify might be having an outage. Glad to learn I can listen to spotify at work.