4 ms·
Githubassets.com Cert Has Expired
Cert expired 5 mins ago.
https://github.com/ https://github.com/
- roryrjb 6y agoJust came to Hacker News to post this, GitHub's assets don't load and the site's front end is broken.
- KriiV 6y agoThis is a wonderful example of what can happen when you don't keep track of your cert expiry dates.
- perryizgr8 6y agoThat's why they are serving un-styled pages, I guess. I thought my browser was acting up.
- leoek 6y agoJust ran into the same issue... Most/Everything still seems to work though, because only the assets are missing ^^ However it is not pretty.
- melco 6y agogithub.githubassets.com expired 1 day ago github.com is OK now
- daenney 6y agoThat doesn't seem to be the case. openssl s_client -connect github.githubassets.com:443 verify error:num=10:certificate has expired notAfter=Nov 2 12:00;00 2020 GMT That's today about 22min ago from time of writing, not 1 day ago. Depending on what your browser still has in its cache, github.com will be in various states of degradation.
- ta8645 6y agoMaybe browsers should put up a warning when a certificate is about to expire; say two weeks away. Nobody should let their certificate get that close to expiring, but if it does, you'd rather it generate a lot of visible warnings before simply ceasing to work at all.
- hannob 6y agoBrowsers are very careful in introducing warnings to users that are meant to go to admins. They dislike the indirect "but users will complain to admins" route and I can't blame them - every warning a user will see and not understand leads to warning fatigue.
- diggan 6y agoOr how about the responsible engineers/testers/managers/whatevers setup proper testing infrastructure for the multi-million projects run by their huge international corporate? Feels like it's not a lot to ask for the most basic testing like checking when certs expire, setup automation to renew it and have fail-safes/error reporting in case the renewal fails.
- KingOfCoders 6y agoTests can have bugs too.
- diggan 6y agoIndeed, that's true! Not only you have to write the tests, you also have to verify it's working, and have monitoring connected to ensure it's continuously working. But still, multi-million companies should surely be able to handle that.
- KingOfCoders 6y agoVerify that it is working after changes, with a test? What is testing that test?
- raptium 6y agoI thought it was just a local CDN node issue until I see this on Hacker News :-(
- lordelph 6y agoThere must be some kind of law "Every company will forget to renew a TLS certificate once" I know I can't throw stones in this particular greenhouse :)
- diggan 6y agoIndeed, together with "deleted production database" it's a rite of passage, which is fine. Problem becomes when same issues pop up over and over again (looking at you Microsoft, re ssl renewals) and nothing is seemingly done to prevent it in the future.
- spydum 6y agoSeems like microsoft has a real issue tracking their cert expiry lately
- SiliconSolder 6y agoNot known on https://www.githubstatus.com/ https://www.githubstatus.com/ yet.
- SiliconSolder 6y agoOk, it is now, although they call it an issue with pull requests.
- thorin 6y agoGithub not working for me either
- mg 6y agoThis is a script I call "certdays.sh" which you can call from your regular tests like this: certdays.sh somedomain.com 14 If the certificate for somedomain.com is valid less then 14 days, it will fail: https://github.com/no-gravity/certdays https://github.com/no-gravity/certdays
- gregoriol 6y agoDon't call it from tests though, call it from a monitoring system!
- contravariant 6y agoIn case anyone is looking for a good option, I've had great success with InfluxDB's telegraph utility which automatically checks both uptime and certificates for HTTPS endpoints, combined with a grafana dashboard that sends alerts when the deadline approaches.
- unilynx 6y agoIs the '25' in 606025 intentional to give a bit more margin or should it just have been 24?
- mg 6y agoHa, I guess I made a typo when I wrote the script 6 months ago. At least I cannot remember that I had some clever idea back then, why a day should have 25 hours. Fixed now. Thanks.
- WrtCdEvrydy 6y agoAlways have days having 25 hours... for DST.
- brianhicks 6y agoWhat shell are you running this under? Unquoted exclamation marks will do things that may be outside your intent for this script. It’ll still fail, just perhaps not in the way you expect.
- deleted 6y ago[deleted]
- unilynx 6y agoif you're using nagios, setup something like command_name check_certificate command_line $USER1$/check_http -H $ARG1$ -p $ARG2$ -4 -S -C 21 -t 20 --sni this won't warn about certificate name mismatches though
- mschuster91 6y agoThat warns only after the fact, not in advance... depending on how the infrastructure (and especially the cert procuring process, for those not using LE for whatever reason) is set up, too late.
- switch007 6y agoNagios checks have thresholds for WARNING and CRITICAL. With these kind of checks it's usually 'days until expiry', so it certainly can be used to warn in advance.
- gerdesj 6y ago"command_line $USER1$/check_http -H $ARG1$ -p $ARG2$ -4 -S -C 21 -t 20 --sni" -C 21 means: Check the certificate. Warn if less than 21 days and critical when expired.
- lysp 6y agoUpdate: Seems to be fixed now.
- sz4kerto 6y agoI remember a couple of years ago I was on the top of some old volcano on an island, and I was dictating shell commands to a colleague so that we can quickly fix our expired certificate. Good old days.
- user5994461 6y agoDon't see any error. The certificate was renewed after 10 minutes of issue? Validity Not Before 11/2/2020, 12:00:00 AM (Greenwich Mean Time) Validity Not After 11/9/2021, 11:59:59 PM (Greenwich Mean Time)
- perryizgr8 6y agoThey renewed it just now.
- sergiotapia 6y agoCerts are such a pain in the ass.
- pupdogg 6y agoOnce identified, I would expect their "Incident Report" in some way would mention the root cause of the incident. However, that does not seem to be the case here: https://www.githubstatus.com/incidents/4mzhxxpwgvqg https://www.githubstatus.com/incidents/4mzhxxpwgvqg Maybe someone could get fired for this or does it have more to do with Microsoft's stock/public image?