16 ms·
W3.org Cert Expired
- LambdaComplex 5y agoMaybe they'll switch to Let's Encrypt now.
- bubalubs 5y agoGandi Standard Wildcard SSL apprently
- spcebar 5y agoHappened to w3schools a few years ago. A sign that there may be room for improvement as far as the process for setting up SSL certificates?
- est31 5y agoACME/Let's encrypt has made this process streamlined enough that no manual involvement is needed any more: https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment https://en.wikipedia.org/wiki/Automated_Certificate_Manageme... I think the main issue is now in increasing deployment of ACME. Let's encrypt has been issuing hundreds of millions of certificates for small websites, but how large is their market share in the serious websites market (Alexa ranks w3.org in the top 10k)? It seems to me that it's covered by different CAs. I wonder which angle Let's encrypt or other ACME/automation based CAs need to improve upon to make themselves attractive to that market.
- Wowfunhappy 5y agoTyping `thisisunsafe` in Chrome to ignore the certificate gave me a 503 error. Perhaps the problem isn't quite what it seems?
- dandigangi 5y agoSame thing.
- judge2020 5y agoThey might use the same certificate on the backends as well, and have the frontend load balancer verifying certificates to prevent MITM.
- lxe 5y agoWow what a neat little trick!
- Wowfunhappy 5y ago"Neat" is one word for it, sure. It's nothing wrong with a user deciding "I realize something is wrong, and I shouldn't trust that anything on this website is legitimate, and I shouldn't give it any information, but I'd still like to read the story/article/blog." There should be a low-opacity button inside the "Advanced" menu.
- Waterluvian 5y agoThey added a button in the form of a hackers only keyboard command. Engineers can be so out of touch sometimes.
- judge2020 5y agoI have a button there: https://i.judge.sh/each/Star/chrome_qziy165xYV.png https://i.judge.sh/each/Star/chrome_qziy165xYV.png But if the button isn't there, that's probably because w3 has HSTS enabled (for past visitors), which tells the browser to never load unencrypted. The `thisisunsafe` workaround is there to be a middle ground between actually making it impossible to load and preventing users loading an unsecure page when they shouldn't.
- wearywanderer 5y agoPeople don't read buttons. However, I share your disdain for Chrome's chosen method; it's very gate-keepery. It requires you to be "in the know"; those who understand the danger but haven't heard of the trick are deliberately left out. I think a reasonable compromise would be a button that pulls up a dialog prompting you to type out a consent message. The dialog tells you what to write instead of keeping this as esoteric knowledge, but the user is still compelled to at least read the warning instead of blindly pressing buttons.
- bawolff 5y agoCompare to firefox which has no bypass. This is the sort of thing, if you're not in the know than you probably dont understand the consequences.
- dilyevsky 5y agoNo look at the cert - it did expire today
- chrismorgan 5y agoThing is it’s not just the certificate that’s down, the website behind the expired certificate is also down. The two are almost certainly connected, though cause and effect is uncertain.
- dilyevsky 5y agoYeah if i had to guess the backend is using the same cert
- deleted 5y ago[deleted]
- efokschaner 5y agoDoes anyone know how to "thisisunsafe" on mobile Chrome?
- orliesaurus 5y agoI clicked Advanced and then it shows Proceed (unsafe)...
- efokschaner 5y agoI don't get that option, and instead get a message referencing HSTS, presumably because at some point in the past my browser picked up the HSTS setting for the site.
- raggi 5y agoInterestingly, it also doesn't allow the CA that it's serving, at least per the CAA records: w3.org. 3599 IN SOA ns1.w3.org. hostmaster.w3.org. ( 2021060201 ; serial 28800 ; refresh (8 hours) 3600 ; retry (1 hour) 604800 ; expire (1 week) 1800 ; minimum (30 minutes) ) w3.org. 3599 IN CAA 0 issuewild "sectigo.com" w3.org. 3599 IN CAA 0 iodef "mailto:sysreq@w3.org" w3.org. 3599 IN CAA 0 issue "amazon.com" w3.org. 3599 IN CAA 0 issue "sectigo.com" w3.org. 3599 IN CAA 0 issue "letsencrypt.org" It does look like the records were updated recently. The spf records are also interesting, but I know nothing about their mail setup. A new Gandi cert was just issued: https://crt.sh/?id=4630660228 https://crt.sh/?id=4630660228 Perhaps it just needs a kick, or it'll be fixed soon.
- bawolff 5y agoCAA only applies at time of issue. Its totally valid for your CAA records to not match the cert you are using, as long as CAA was ok at issue time.
- raggi 5y agoWhich it appears that it was not, at the time that cert was issued! I have no idea if CAB have made CAA a requirement, but I presume not.
- MattyMc 5y agoBad cert. great website.
- djabatt 5y agoSSL certs are such a pain to manage in orgs.
- deathanatos 5y agoAnd because I violent agree with this: even w/ Let's Encrypt this is still a pain. (Though, it is at least a better engineered pain, and theoretically tractable.) DNS providers that have bugs¹, services that want to host on port 80 & won't let me proxy them through nginx, auditors that want block port 80 (guess what ACME uses), services that generate malformed X.509 certs (golang's standard library…), programs that want certs in weird formats (PKCS#12 & Java, I'm looking at you), bad OpenSSL defaults, the rate limits (sorry LE, they're still too low) and just there are probably about 2 dozen people who really understand X.509 & web PKI and the rest of my company it is wizardry (it really isn't). ¹a certain large provider for the longest time failed to handle having two TXT records, which ACME requires in some circumstances.
- est31 5y ago> services that generate malformed X.509 certs (golang's standard library…) In which way are those certificates malformed? Is it because they don't have the extensions needed to pass certlint?
- deathanatos 5y agoMalformed subject, IIRC. It's not every cert, mind you (I didn't intend to imply that) it's just the ones that happen to not specify some element. Unfortunately, it's the default of a utility that we use, that's written in Go. It generates a very long-lived cert on start, and by default, it'll be malformed. We have another utility (that crawls certs looking for ones near expiry. That cert trips it up. (And it now has a configurable ignore-list specifically so that we can ignore that cert.) But more and more I appreciate libraries who (produce well-formed output) xor (error). Go also has a "simpler" interface to X.509 in its standard library that will easily produce the wrong (but well-formed; i.e., wrong semantically, not syntactically / not what any user is gong to want) output under very easy-to-accomplish circumstances.
- ddtaylor 5y agoWithout HTTPS does work currently: curl 'http://www.w3.org/' I'm one of the people who really think that HTTPS should be enabled by default and the only HTTP traffic that should be allowed are permanent redirects with a pinning header.
- fooey 5y agoJust a few years ago, that was prohibitively expensive, but the browsers are pushing everything to https only pretty hard now. Most setups are nearly seamless for getting a free cert going now, but there'll always be a few old sites that no one will ever update
- SilverRed 5y agoIt was a huge mistake to have browsers treat an expired cert with so much force. An expired cert website is at the least, just as good as a http site and yet entirely unencrypted sites see a few warnings on login forms while expired cert sites are unaccessable.
- joering2 5y agoIts worst than that. Google chrome doesn't like more sites than others. On most you can simply click "proceed to danger" and ignore missing cert. On some other like cryptome, they don't even give you option to continue. https://cryptome.org/ https://cryptome.org/
- judge2020 5y agoThis is generally enforced by HSTS - one of the features is that, if the site has it enabled and the site has a TLS-related error, the browsers prevent users from bypassing the SSL error screen (at least, without typing `thisisunsafe` in chrome). https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St... https://security.stackexchange.com/q/195688/96942 https://security.stackexchange.com/q/195688/96942
- weedfroglozenge 5y agoI'm glad I saw this comment - What can make a site perform like that? At work we use Chrome as our general browser, and we've had several issues with expired certs before. Some websites allowed you to expand the box and opt "Continue" but some simply didn't have the option. Whats the difference?
- eropple 5y agoSites can opt into "do not let somebody continue if the cert is bad" via HSTS.
- bmcahren 5y agoHTTP Strict Transport Security (HSTS) is enabled at the DNS level which tells modern browsers "I'm a modern website and want to only be served on valid certificates, otherwise refuse to allow access to my website because something must be very wrong for this to happen". The assumption is "must be very wrong" is an attack you don't want people to "continue" past. Occasionally it bites back like this if you don't maintain your certificates. Offering HTTP transport invites attackers to inject advertisements, malware, or viruses into your packet stream. ISP like comcast and ATT are notorious for doing this. Allowing falsified or expired certificates invites attackers as well. HTST This is a good thing.
- istillwritecode 5y agoLet's be clear. Google insists on https because it keeps ISPs from intruding on their ads business. The other threats are small potatoes.
- edflsafoiewq 5y agoJust encryption would do that, you don't need certs right?
- Hackbraten 5y agoThen the ISP would simply decrypt the traffic, insert their ads, and encrypt again.
- deleted 5y ago[deleted]
- wearywanderer 5y ago> Google insists on https because it keeps ISPs from [injecting any of their horseshit into my traffic.] Huh, that's precisely why I insist on https.
- IceWreck 5y agoIn India, even govt run ISPs inject their ads on http sites.
- shcheklein 5y agoThe easiest way to manage I've found so far - put it behind Cloudflare. Caching, certs management, www. redirect handling (with SSL support), basic protection - all comes for free. You would need to install their own cert on your infra, but it has 10 or 15 year to expire.
- sen 5y agoThen you're shunning anyone who uses a VPN, anyone who uses privacy plugins, etc etc. I despise Cloudflare these days because I'm pretty much required to use a VPN to access the web and get around geolocked content everywhere, and then Cloudflare blocks me from browsing even basic static sites.
- shcheklein 5y agoInteresting, I've never tried this. I'll check it out.
- selcuka 5y agoCloudFlare, being a reverse proxy, has many limitations (such as forced cookies and the upload limit) but I agree that it is ok for many use cases. Let's Encrypt is easily automated and doesn't have any of those downsides.
- EE84M3i 5y agoAre there still "forced cookies" after this change? https://blog.cloudflare.com/deprecating-cfduid-cookie/ https://blog.cloudflare.com/deprecating-cfduid-cookie/
- notatoad 5y ago>it has 10 or 15 years to expire Dont browsers reject certs with longer than one year validity?
- StopHammoTime 5y agoThey’re talking about the cert between edge and origin (I.e. cloudflare and your server). The client never sees that cert because they don’t talk directly to your origin.
- tony-allan 5y agoThis is more than a certificate problem… 503 Service Unavailable No server is available to handle this request.
- selcuka 5y agoThey probably use the same certificate on their backend servers and their load balancers refuse to proxy them.
- hughes 5y agoAttempting to view w3.org currently crashes Safari 14.1 on an M1 Mac running Big Sur 11.3.
- gfody 5y agoA grace period would have been a lovely feature to bake into this from the beginning. It's too late now of course.. oh well. I feel for you w3.org devs I've been on the other side of this many times.
- toast0 5y agoThere's not really any reasonable action for a visitor to take if a certificate is almost expired, so I don't know what a grace period would get you. Some CAs are nice enough to issue certs with the Not Before date a day or so before the time at issuance, which is super handy for all the devices with wrong time and software that does odd things with timezone conversions.
- gscott 5y agoBring back 3 year certs please
- arpa 5y agostop treating self-issued certs as inherently insecure, please.
- judge2020 5y agoThis is impossible since you can't be certain that a self signed cert is issued by $isp or $government versus the website owner.
- arpa 5y agoif I issued the cert myself, for sure I can ;)
- gscott 5y agoWhat really is the difference between a $5 secure certificate from ssls.com, a self-signed cert, a $60 godaddy cert, and a lets encrypt ssl. Just about nothing right? So why not trust self-signed certs.
- judge2020 5y agoEverything other than a self signed certificate has technical checks requiring that the person requesting issuance of the domain actually has control over the domain via dns or http challenges. Without those you (or your ISP or government) could self-issue accounts.google.com (or api.stripe.com or bankofamerica.com) and MITM people to steal information that otherwise would be presumed private to middlemen.