3 ms·
I'm a little surprised by this. They're using an AWS Certificate which means the entire certificate lifecycle should be fully automated[1]. Assuming they use DN
by RulerOf 3y ago
I'm a little surprised by this. They're using an AWS Certificate which means the entire certificate lifecycle should be fully automated[1]. Assuming they use DNS validation, I speculate that somebody deleted the validation CNAME record and then the doom-and-gloom renewal emails went to an unmonitored mailbox. Then they ignored it so long it ended up on HN.
Gfycat publishes an HSTS header, so they're under _hard_ downtime too.
1: https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html https://docs.aws.amazon.com/acm/latest/userguide/managed-ren...
- web007 3y agoMost likely someone stopped paying the AWS bill. If you `curl -k` to avoid the HSTS problem you see that CloudFront and/or lambda aren't working either.
- KomoD 3y agoWorks just fine for me when I bypass HSTS...
- aaomidi 3y agoAn RFC draft I’ve been working on tries to address this somewhat: https://datatracker.ietf.org/doc/draft-todo-chariton-dns-account-01/ https://datatracker.ietf.org/doc/draft-todo-chariton-dns-acc...
- ehPReth 3y agothey're also HSTS preloaded in https://source.chromium.org/chromium/chromium/src/+/main:net/http/transport_security_state_static.json https://source.chromium.org/chromium/chromium/src/+/main:net...