4 ms·

Microsoft forgot to renew their Office CDN certificate

57 points by 4ggr0 2y ago

2sk21 2y ago
When it comes to certificates, mess-ups happen frequently in big companies. When I worked at IBM, I initially had the responsibility for obtaining and renewing the code signing certificate for a Java applet that we used in our product. I handed off the responsibility to another employee when I left that group. I was on vacation in the middle of nowhere when I got a panicked call from the product manager asking me to renew the certificate as the employee had quit. I had to spend half a day walking someone through the renewal process - ruined my day.
- surfingdino 2y ago
  I have certificate related horror stories from projects in the past. It takes a long time to train people to care for all the details and renewals. I spent weeks trying to get an upset client to understand that they messed up CSRs and have to ask the CA to issue new ones. The client refused to accept the simple fact that they made a mistake an wanted an exception to how PKI works.
  - 4ggr0 2y ago
    i'm sure that i've spent a large part of my time trying to figure out why certs weren't working, converting them from one format to another and randomly having to try things until they work. just today i had to fix our internal certs because for the new ones someone forgot to include the intermediate cert in the chain, making it impossible to use a specific CLI tool. web browsers didn't complain, just the CLI sync tool :)
    - surfingdino 2y ago
      Cryptography is a cruel mistress. One bit off and you're out.
- jmclnx 2y ago
  I feel for you, when I worked at IBM I was surprised they did not have a "known" central authority for creating/maintaining certs. We tried to find if one existed, but no luck. In the Dept I was in, it was expected the downstream system people would create the certs, and of course I would say 85% of them did not even know what a cert is. When renewal time came, we got blank stares when we mentioned the private cert. Or the person who created the cert left and never trained their replacement. Crazy situation. I hope things changed since I left.
  - 2sk21 2y ago
    Yeah - it was pretty chaotic when I was there too. We had to use the internal purchase order system to buy certificates from a CA. It was cumbersome as it required several levels of approval. I have long since quit IBM thankfully and had forgotten all about it until I saw this post today :-)
deleted 2y ago
[deleted]
adolph 2y ago
It’s a classic story starting in the 90s. Here is one from 2002: He learned through Slashdot, an online discussion group, that Microsoft had an outstanding $35 fee to Network Solutions (NSI) for the Passport.com Web address. The Passport site verifies user identification and passwords for access to Hotmail and about 25 other Microsoft services. Chaney, 31, quickly paid the fee with his credit card, restoring service to Hotmail users. https://www.cnet.com/tech/services-and-software/oregon-company-makes-top-bid-for-microsoft-check/ https://www.cnet.com/tech/services-and-software/oregon-compa...
- surfingdino 2y ago
  Classic.
johnbellone 2y ago
https://officecdn.microsoft.com https://officecdn.microsoft.com > Validity > Not Before - Fri, 18 Aug 2023 02:17:43 GMT > Not After - Thu, 27 Jun 2024 23:59:59 GMT > Subject Alternative Name > DNS Name - cdn.entity.osi.office.net > DNS Name - cdn.entity.osi.officeppe.net > DNS Name - cdn.uci.edog.officeapps.live.com > DNS Name - cdn.uci.officeapps.live.com > DNS Name - uci.cdn.office.net > DNS Name - uci.edog.cdn.office.net [1]: https://crt.sh/?id=12376893471 https://crt.sh/?id=12376893471
- johnbellone 2y ago
  It looks like https://businessaccount.microsoft.com/ https://businessaccount.microsoft.com/ domain is also affected. [1]: https://crt.sh/?id=9852030995 https://crt.sh/?id=9852030995
  - 4ggr0 2y ago
    i feel a bit dumb right now... always thought that using *.domain.net for home-use was cool, because that way random people don't know what kinds of subdomains i use. turns out they can find it out by just checking all the certs for my domain. well. the more you know.
    - Caligatio 2y ago
      I have a reverse proxy that is in front of all my services (caddy) which uses a wildcard cert to avoid this very concern.
      - 4ggr0 2y ago
        i use NPM at home. tested caddy a bit but i really liked NPMs convenience of having a Web-UI. allows me to do stuff remotely on my phone without having to dive into conf files. anyways, what i liked about caddy was how easily it handles SSL-certs, for sure makes it easier to use! :) gonna have to look into how i can give a wildcard-cert to my rev-proxy.
    - kenny11 2y ago
hatware 2y ago
[dead]
imzadi 2y ago
Supposedly it's been renewed, but my users are still seeing the errors.

57 points by 4ggr0 2y ago

When it comes to certificates, mess-ups happen frequently in big companies. When I worked at IBM, I initially had the responsibility for obtaining and renewing the code signing certificate for a Java applet that we used in our product. I handed off the responsibility to another employee when I left that group. I was on vacation in the middle of nowhere when I got a panicked call from the product manager asking me to renew the certificate as the employee had quit. I had to spend half a day walking someone through the renewal process - ruined my day.

surfingdino 2y ago
I have certificate related horror stories from projects in the past. It takes a long time to train people to care for all the details and renewals. I spent weeks trying to get an upset client to understand that they messed up CSRs and have to ask the CA to issue new ones. The client refused to accept the simple fact that they made a mistake an wanted an exception to how PKI works.
- 4ggr0 2y ago
  i'm sure that i've spent a large part of my time trying to figure out why certs weren't working, converting them from one format to another and randomly having to try things until they work. just today i had to fix our internal certs because for the new ones someone forgot to include the intermediate cert in the chain, making it impossible to use a specific CLI tool. web browsers didn't complain, just the CLI sync tool :)
  - surfingdino 2y ago
    Cryptography is a cruel mistress. One bit off and you're out.
jmclnx 2y ago
I feel for you, when I worked at IBM I was surprised they did not have a "known" central authority for creating/maintaining certs. We tried to find if one existed, but no luck. In the Dept I was in, it was expected the downstream system people would create the certs, and of course I would say 85% of them did not even know what a cert is. When renewal time came, we got blank stares when we mentioned the private cert. Or the person who created the cert left and never trained their replacement. Crazy situation. I hope things changed since I left.
- 2sk21 2y ago
  Yeah - it was pretty chaotic when I was there too. We had to use the internal purchase order system to buy certificates from a CA. It was cumbersome as it required several levels of approval. I have long since quit IBM thankfully and had forgotten all about it until I saw this post today :-)

deleted 2y ago

[deleted]

adolph 2y ago

It’s a classic story starting in the 90s. Here is one from 2002: He learned through Slashdot, an online discussion group, that Microsoft had an outstanding $35 fee to Network Solutions (NSI) for the Passport.com Web address. The Passport site verifies user identification and passwords for access to Hotmail and about 25 other Microsoft services. Chaney, 31, quickly paid the fee with his credit card, restoring service to Hotmail users. https://www.cnet.com/tech/services-and-software/oregon-company-makes-top-bid-for-microsoft-check/ https://www.cnet.com/tech/services-and-software/oregon-compa...

surfingdino 2y ago
Classic.

johnbellone 2y ago

https://officecdn.microsoft.com https://officecdn.microsoft.com > Validity > Not Before - Fri, 18 Aug 2023 02:17:43 GMT > Not After - Thu, 27 Jun 2024 23:59:59 GMT > Subject Alternative Name > DNS Name - cdn.entity.osi.office.net > DNS Name - cdn.entity.osi.officeppe.net > DNS Name - cdn.uci.edog.officeapps.live.com > DNS Name - cdn.uci.officeapps.live.com > DNS Name - uci.cdn.office.net > DNS Name - uci.edog.cdn.office.net [1]: https://crt.sh/?id=12376893471 https://crt.sh/?id=12376893471

johnbellone 2y ago
It looks like https://businessaccount.microsoft.com/ https://businessaccount.microsoft.com/ domain is also affected. [1]: https://crt.sh/?id=9852030995 https://crt.sh/?id=9852030995
- 4ggr0 2y ago
  i feel a bit dumb right now... always thought that using *.domain.net for home-use was cool, because that way random people don't know what kinds of subdomains i use. turns out they can find it out by just checking all the certs for my domain. well. the more you know.
  - Caligatio 2y ago
    I have a reverse proxy that is in front of all my services (caddy) which uses a wildcard cert to avoid this very concern.
    - 4ggr0 2y ago
      i use NPM at home. tested caddy a bit but i really liked NPMs convenience of having a Web-UI. allows me to do stuff remotely on my phone without having to dive into conf files. anyways, what i liked about caddy was how easily it handles SSL-certs, for sure makes it easier to use! :) gonna have to look into how i can give a wildcard-cert to my rev-proxy.
  - kenny11 2y ago

hatware 2y ago

[dead]

imzadi 2y ago

Supposedly it's been renewed, but my users are still seeing the errors.