4 ms·

> Every place I've worked which has had issues with last minute certificate changes or expiring certificates without renewal has had a systemic problem with und

> Every place I've worked which has had issues with last minute certificate changes or expiring certificates without renewal has had a systemic problem with underpaid and understaffed IT department. That's an interesting anecdote, but its quite easy to find examples of companies with well respected, well paid engineering teams that still have an occasional certificate expire. Microsoft[0], Spotify[1], Facebook[2], Apple[3] have all had embarrassing outages due to certificates expiring. [0]: https://www.theverge.com/2020/2/3/21120248/microsoft-teams-down-outage-certificate-issue-status https://www.theverge.com/2020/2/3/21120248/microsoft-teams-d... [1]: https://www.theverge.com/2020/8/19/21375032/spotify-down-songs-loading-issues-outage https://www.theverge.com/2020/8/19/21375032/spotify-down-son... [2]: https://www.theverge.com/2018/3/7/17092084/oculus-rift-headsets-stopped-working-expired-certificate https://www.theverge.com/2018/3/7/17092084/oculus-rift-heads... [3]: https://www.theverge.com/2015/11/12/9721108/apple-mac-app-store-bug-security-certificate https://www.theverge.com/2015/11/12/9721108/apple-mac-app-st...

machello13 6y ago
The Apple issue was not a case of forgetting to renew a certificate, certain 3rd party apps just weren't handling the upgrade correctly. So maybe not quite as easy to find examples after all.
xtracto 6y ago
Right handling certificates is one of those chores that, particularly in a startup is easy to oversee. If the average turnaround for employees is 2 years, and a certificate can be bought for a bit more than 2 years. Normally someone will put it in their calendar and leave the company before it expired, so the new employee will be welcomed by an expired certificate and a not-so-clear list of places where to place it. That´s why things like AWS certificate manager + ELB kind of things are useful, so that they are mostly auto-renewed. It is a chore that had bit most of the places where I have worked.

machello13 6y ago

The Apple issue was not a case of forgetting to renew a certificate, certain 3rd party apps just weren't handling the upgrade correctly. So maybe not quite as easy to find examples after all.

xtracto 6y ago

Right handling certificates is one of those chores that, particularly in a startup is easy to oversee. If the average turnaround for employees is 2 years, and a certificate can be bought for a bit more than 2 years. Normally someone will put it in their calendar and leave the company before it expired, so the new employee will be welcomed by an expired certificate and a not-so-clear list of places where to place it. That´s why things like AWS certificate manager + ELB kind of things are useful, so that they are mostly auto-renewed. It is a chore that had bit most of the places where I have worked.