4 ms·

I've got an old iPad that's still running iOS 10.0.1 (yes, I know). It's used very infrequently and mostly just for reading (PDF documentation, primarily). Coi

I've got an old iPad that's still running iOS 10.0.1 (yes, I know). It's used very infrequently and mostly just for reading (PDF documentation, primarily). Coincidentally, I happened to be in the middle of looking something up right as the clock struck "NotAfter". My first clue that "something was up" came when clicking a link to another page on one of the sites I had opened... I switched tabs, clicked a link to some other page on that site... nope. Then, I tried visiting a few random sites that are bookmarked. Some loaded just fine, others through errors. Out of habit, I glanced at the clock -- my ISP's maintenance windows typically start at 2am and they are very good at starting at exactly that time! It wasn't 2am, but it was just past the top of the hour at this point. I don't recall now if the errors displayed were certificate-related specifically or just "generic" in nature, but I suddenly recalled seeing an article in the past day or two reminding us all of the impending doom and destruction that was about to be unleashed upon us when the root certificate expired. Using the Firefox browser (which was up-to-date) on my workstation, I tried loading a couple of the sites that were refusing to load on the iPad but I encountered no issues whatsoever -- everything was fine. A quick check of the certificate chain on the "affected" sites confirmed the cause of my problems. Back on the iPad, I downloaded a copy of the "new" root certificate from my workstation, confirmed, confirmed, confirmed, and was back to whatever it was I was looking into by 10 minutes past the hour. Somehow I managed to escape all of the Y2K-level atrocities that were supposed to occur and had totally forgotten about the entire "incident" until seeing this here -- and, as you might guess, haven't ran into any other issues related to this since then. Apocalypse averted (for now), I suppose.

tialaramex 5y ago
Yes. The procedure you describe could also have been done any time prior to expiry, and more easily of course since the web still worked back then. The time is completely arbitrary by the way, the people who minted the certificate could of course choose something else, but by default it's likely if it happens to be 14:26:39 UTC when you make the certificate, it's also going to expire at 14:26:39 UTC however many years in the future. It's a little disappointing that sites catering to people who run old stuff (e.g. both old iPads and old Macs) didn't put much work into e.g. low friction ways to make this happen. Perhaps that's something where Let's Encrypt should have reached out to the right people and made sure this was on their agenda back in the summer. But perhaps most people in your situation don't pay any attention to such things anyway and would still have been blind-sided.

tialaramex 5y ago

Yes. The procedure you describe could also have been done any time prior to expiry, and more easily of course since the web still worked back then. The time is completely arbitrary by the way, the people who minted the certificate could of course choose something else, but by default it's likely if it happens to be 14:26:39 UTC when you make the certificate, it's also going to expire at 14:26:39 UTC however many years in the future. It's a little disappointing that sites catering to people who run old stuff (e.g. both old iPads and old Macs) didn't put much work into e.g. low friction ways to make this happen. Perhaps that's something where Let's Encrypt should have reached out to the right people and made sure this was on their agenda back in the summer. But perhaps most people in your situation don't pay any attention to such things anyway and would still have been blind-sided.