4 ms·
Yep. I broke a system at work this way. I needed a piece of crytopgraphic information generated by an internal system for testing. The system requires all piece
by sargun 6y ago
Yep. I broke a system at work this way. I needed a piece of crytopgraphic information generated by an internal system for testing. The system requires all pieces are signed (with an accompanying expiration date). I decided to ask for it to be signed for 100 years.
...This resulted in the service generating an invalid x509 certificate [but fortunately the validation library said that the cert was invalid, just didn't tell me why] -- making me lose a day to debugging this mistake.
- ncmncm 6y agoThe real mistake was wanting a certificate life longer than the expected time to crack it.
- danielheath 6y agoFor test systems? Unless you are testing key rotation, who cares?
- ncmncm 6y agoPoint taken. The certificate generator program should have reported the error. Everything connected with x.509 barely works. Somebody should standardize an x.509.good_parts subset that leaves out all the crap nobody needs and doesn't work anyway in deployed systems.
- beambot 6y agoFor systems that are infrequently (or sometimes, never) updated, you might want to sign firmware images for as long as possible to ensure the devices can (a) support signed updates from the OEM; and (b) can work indefinitely even if the OEM disappears.