3 ms·

Ha. Their EV test (which they say you should be able to connect to, if your browser is "good") uses a certificate that expired Aug 10 2022: https://extended-val

Ha. Their EV test (which they say you should be able to connect to, if your browser is "good") uses a certificate that expired Aug 10 2022: https://extended-validation.badssl.com https://extended-validation.badssl.com

cipherboy 4y ago
Yeah there's a GitHub repo behind this and there's comments from past times it has expired. Essentially it requires a public CA to issue an EV cert for them, which is hard to maintain and rotate. I think Mozilla and DigiCert worked on this iirc.
- cmeacham98 4y ago
  Many of their other non-EV certificates are expired as well, for example: https://sha384.badssl.com/ https://sha384.badssl.com/
  - selcuka 4y ago
    To be fair finding working SSL sites is easy. Broken ones, especially for uncommon reasons, are the problem. I have used BadSSL for such tests many times in the past.
  - cipherboy 4y ago
    I believe 384 has the same problem: most CAs use RSA-2048/SHA-256 signatures and very few do 2048/384 (which this certificate is doing), especially on demand (ACME has no parameter to control hash function selection by the requester for instance) SHA384 with P-384 is much more common (and tested elsewhere on the site); what is unique about this one is using a larger hash with RSA keys. Like some of the other certs, it requires partnerships with CAs willing to bend their process a little for the sake of publicly available test infra.
ghusto 4y ago
Which is why security via corporate checkboxes _decreased_ security. "We verify the company address by having someone physically check it" sounds great on paper (the currency of C levels), but everyone else understands that this means you won't be renewing rotating it as often.
- dale_glass 4y ago
  Security is about tradeoffs. What's the benefit in rotating certificates, if the certificate is issued to the wrong entity? Though on a second thought I'm not sure what you're getting at. Certificate renewal isn't optional. It's valid for however long it's valid.

cipherboy 4y ago

Yeah there's a GitHub repo behind this and there's comments from past times it has expired. Essentially it requires a public CA to issue an EV cert for them, which is hard to maintain and rotate. I think Mozilla and DigiCert worked on this iirc.

cmeacham98 4y ago
Many of their other non-EV certificates are expired as well, for example: https://sha384.badssl.com/ https://sha384.badssl.com/
- selcuka 4y ago
  To be fair finding working SSL sites is easy. Broken ones, especially for uncommon reasons, are the problem. I have used BadSSL for such tests many times in the past.
- cipherboy 4y ago
  I believe 384 has the same problem: most CAs use RSA-2048/SHA-256 signatures and very few do 2048/384 (which this certificate is doing), especially on demand (ACME has no parameter to control hash function selection by the requester for instance) SHA384 with P-384 is much more common (and tested elsewhere on the site); what is unique about this one is using a larger hash with RSA keys. Like some of the other certs, it requires partnerships with CAs willing to bend their process a little for the sake of publicly available test infra.

ghusto 4y ago

Which is why security via corporate checkboxes _decreased_ security. "We verify the company address by having someone physically check it" sounds great on paper (the currency of C levels), but everyone else understands that this means you won't be renewing rotating it as often.

dale_glass 4y ago
Security is about tradeoffs. What's the benefit in rotating certificates, if the certificate is issued to the wrong entity? Though on a second thought I'm not sure what you're getting at. Certificate renewal isn't optional. It's valid for however long it's valid.