3 ms·

I have the misfortune of being forced to use GoDaddy for a certificate. For reasons I won't go into Let's Encrypt isn't an option. The certificates that Cloudfl

I have the misfortune of being forced to use GoDaddy for a certificate. For reasons I won't go into Let's Encrypt isn't an option. The certificates that Cloudflare provisions (even when not using their universal SSL feature) are issued by a CA which isn't supported by all versions of Apple Podcasts. GoDaddy was the only viable option. GoDaddy has repeatedly fucked this up. Once, they renewed the cert, but didn't publish it to the logs of issued certs. So Chrome started rejecting the new cert. Hard downtime. It took almost 24 hours for them to issue the guidance to "just renew it again and hopefully it will work this time...we'll refund the first one". Crazy.

dlgeek 6y ago
If you have evidence they didn't log it to CT, that's a miss-issuance and reporting it to the root programs (via the Mozilla list) will trigger an investigation that will be taken very seriously.
deleted 6y ago
[deleted]
tialaramex 6y ago
> Once, they renewed the cert, but didn't publish it to the logs of issued certs. For what it's worth, you can log certificates. It's not common for issuers to even offer certificates that haven't already been logged, but some applications want that, and it's perfectly possible to do it, Google do it for some systems. The issuer has no special right to log certificates, broadly anybody can do it (big issuers have some agreement for volume performance, but you're probably only doing one or two by hand so who cares). Major logs just have a public endpoint, you give them a certificate they give you back an SCT (the timestamped "proof" it was logged). The modern logs tend to have two constraints: The certificate must be from a CA they trust (in almost all cases that's going to be a similar list to the list Chrome uses) and it must expire in the right year because they've all sharded their backend systems by expiry date, this way all the 2019 expired certificates can get flushed away in 2020 rather than needing valuable always on-line storage forever. Your HTTP server needs to actually give the SCT to the web browser (whereas if it was baked into the certificate that's not your problem) but you can configure popular servers to do that.

dlgeek 6y ago

If you have evidence they didn't log it to CT, that's a miss-issuance and reporting it to the root programs (via the Mozilla list) will trigger an investigation that will be taken very seriously.

deleted 6y ago

[deleted]

tialaramex 6y ago

> Once, they renewed the cert, but didn't publish it to the logs of issued certs. For what it's worth, you can log certificates. It's not common for issuers to even offer certificates that haven't already been logged, but some applications want that, and it's perfectly possible to do it, Google do it for some systems. The issuer has no special right to log certificates, broadly anybody can do it (big issuers have some agreement for volume performance, but you're probably only doing one or two by hand so who cares). Major logs just have a public endpoint, you give them a certificate they give you back an SCT (the timestamped "proof" it was logged). The modern logs tend to have two constraints: The certificate must be from a CA they trust (in almost all cases that's going to be a similar list to the list Chrome uses) and it must expire in the right year because they've all sharded their backend systems by expiry date, this way all the 2019 expired certificates can get flushed away in 2020 rather than needing valuable always on-line storage forever. Your HTTP server needs to actually give the SCT to the web browser (whereas if it was baked into the certificate that's not your problem) but you can configure popular servers to do that.