6 ms·

The cert for objects.githubusercontent.com has also expired: $ openssl s_client -connect objects.githubusercontent.com:443 CONNECTED(00000005) dep

by koolba 4y ago

The cert for objects.githubusercontent.com has also expired: $ openssl s_client -connect objects.githubusercontent.com:443 CONNECTED(00000005) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io verify error:num=10:certificate has expired notAfter=Mar 21 23:59:59 2023 GMT verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io notAfter=Mar 21 23:59:59 2023 GMT verify return:1 --- Certificate chain 0 s:C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io i:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 1 s:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA What are the odds this happens the same day they rotate their SSH keys?

brandur 4y ago
It's also the domain used for releases and other artifacts (after a redirect from github.com). There's going to be a lot of broken builds today: $ curl -i -L https://github.com/kyleconroy/sqlc/releases/download/v1.17.0/sqlc_1.17.0_linux_amd64.tar.gz HTTP/2 302 server: GitHub.com date: Fri, 24 Mar 2023 20:51:56 GMT content-type: text/html; charset=utf-8 location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/193160679/09048595-c7f4-45b5-858a-7f55baa2fd7d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230324%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230324T205156Z&X-Amz-Expires=300&X-Amz-Signature=772d0aa8c5c19b0a5ef84d718d2faf0d81f24b224a4ef634d2410787e8f50bad&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=193160679&response-content-disposition=attachment%3B%20filename%3Dsqlc_1.17.0_linux_amd64.tar.gz&response-content-type=application%2Foctet-stream curl: (60) SSL certificate problem: certificate has expired More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. > What are the odds this happens the same day they rotate their SSH keys? Definitely a bad for them. When it rains, it pours.
- nwatson 4y ago
  They laid off the wrong person.
  - AviationAtom 4y ago
    This is so comical because it's so relevant. Do you think people architect poorly designed systems more often than not as a means of job security or just a failure to put much forethought in whilst planning it?
    - tomrod 4y ago
      Failure of forethought with the wrong deadlines in place, soup to nuts.
    - reaperducer 4y ago
      Or maybe just laziness. I know someone who joined a company and found a dead-man's switch in the server. He could have taken it out, but instead he just resets it every three months, just like the guy before him. If the company ever gets rid of him and doesn't hire someone equally skilled and thorough, the production server will eat itself right about the time his unemployment benefits run out.
    - misnome 4y ago
      I’d more bet on “Warning for years that this is a point of failure but management wants to chase $shiny instead”
      - remram 4y ago
        I guess copilot can't write monitoring rules.
      - blooalien 4y ago
        > I’d more bet on “Warning for years that this is a point of failure but management wants to chase $shiny instead” I'd almost guarantee you're right on the money with that line of thinking…
AviationAtom 4y ago
Could be a good chance. I'd venture to guess they failed to update the known_hosts file for one of their systems that handles certificate management. Strictly me taking a stab at the answer though.
belter 4y ago
Now they are owned by Microsoft, its a celebratory 10 year tradition. Cause a worldwide outage, by letting your certificate expire... "Windows Azure Service Disruption from Expired Certificate" (2013) - https://azure.microsoft.com/en-us/blog/windows-azure-service-disruption-from-expired-certificate/ https://azure.microsoft.com/en-us/blog/windows-azure-service...

by koolba 4y ago

brandur 4y ago

It's also the domain used for releases and other artifacts (after a redirect from github.com). There's going to be a lot of broken builds today: $ curl -i -L https://github.com/kyleconroy/sqlc/releases/download/v1.17.0/sqlc_1.17.0_linux_amd64.tar.gz HTTP/2 302 server: GitHub.com date: Fri, 24 Mar 2023 20:51:56 GMT content-type: text/html; charset=utf-8 location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/193160679/09048595-c7f4-45b5-858a-7f55baa2fd7d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230324%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230324T205156Z&X-Amz-Expires=300&X-Amz-Signature=772d0aa8c5c19b0a5ef84d718d2faf0d81f24b224a4ef634d2410787e8f50bad&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=193160679&response-content-disposition=attachment%3B%20filename%3Dsqlc_1.17.0_linux_amd64.tar.gz&response-content-type=application%2Foctet-stream curl: (60) SSL certificate problem: certificate has expired More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. > What are the odds this happens the same day they rotate their SSH keys? Definitely a bad for them. When it rains, it pours.

nwatson 4y ago
They laid off the wrong person.
- AviationAtom 4y ago
  This is so comical because it's so relevant. Do you think people architect poorly designed systems more often than not as a means of job security or just a failure to put much forethought in whilst planning it?
  - tomrod 4y ago
    Failure of forethought with the wrong deadlines in place, soup to nuts.
  - reaperducer 4y ago
    Or maybe just laziness. I know someone who joined a company and found a dead-man's switch in the server. He could have taken it out, but instead he just resets it every three months, just like the guy before him. If the company ever gets rid of him and doesn't hire someone equally skilled and thorough, the production server will eat itself right about the time his unemployment benefits run out.
  - misnome 4y ago
    I’d more bet on “Warning for years that this is a point of failure but management wants to chase $shiny instead”
    - remram 4y ago
      I guess copilot can't write monitoring rules.
    - blooalien 4y ago
      > I’d more bet on “Warning for years that this is a point of failure but management wants to chase $shiny instead” I'd almost guarantee you're right on the money with that line of thinking…

AviationAtom 4y ago

Could be a good chance. I'd venture to guess they failed to update the known_hosts file for one of their systems that handles certificate management. Strictly me taking a stab at the answer though.

belter 4y ago

Now they are owned by Microsoft, its a celebratory 10 year tradition. Cause a worldwide outage, by letting your certificate expire... "Windows Azure Service Disruption from Expired Certificate" (2013) - https://azure.microsoft.com/en-us/blog/windows-azure-service-disruption-from-expired-certificate/ https://azure.microsoft.com/en-us/blog/windows-azure-service...