7 ms·

I think you're trying to solve a non-problem since the company that sells the certificates warns you (sometimes even more than those intervals), afterall, they

I think you're trying to solve a non-problem since the company that sells the certificates warns you (sometimes even more than those intervals), afterall, they want you to renew as well. As for checking for quality, that should be the sys admin task or the webmaster. good luck though!

ianmcgowan 12y ago
Perhaps a non-problem for startups, but it's definitely a problem for bigger companies where the group that purchases certs may not be the one using them...
- danielbln 12y ago
  I would think that bigger companies would use dedicated IT staff over a start-up for something crucial like SSL cert checking.
  - aroch 12y ago
    Given that Microsoft and Amazon have both had their SSL certs for their cloud businesses expire, a little extra reminding probably can't hurt. That said, I wouldn't pay for a service like this from a random person, I'd have my registrar do it (MarkMonitor or similar -- that's why they're paid the big bucks).
    - yourabi 12y ago
      Thanks for the feedback and thoughts, aroch. Can I ask why you wouldn't pay a "random person" as you say - since this information is by definition public? Can you tell me a bit about your experience using MarkMonitor to do this?
      - aroch 12y ago
        I don't see the value in paying someone and then trusting them with something (as you say) important to my business when they have no track record. For my personal set of servers (some 25-30, with ~50 SSL certs), I have Nagios for monitoring them plus calendar alerts, SMS alerts and sane cycling (everything expires in the same month). My employer is an intermediary CA, they can issue their own certs but I've worked with people who use Markmonitor. As part of buying your cert through them is they worry about making sure your domains stay protected. They'll call you, text you and even mail you reminders. And they have a proven track record dealing with companies that are collective worth trillions.
    - ianmcgowan 12y ago
      [Full disclosure - I've been beta testing snitch and been very happy with it]. In an old job for a mid-level bank, we had many behind the scenes (never showed up as a green padlock in any browser) integrations that would quit working when certs expired, frequently ones that we didn't purchase or control. At the time, it was definitely worth it to me to get some notice before that happened. And it can be easier to plonk down a credit card than work though internal processes to have nagios (or patrol express, <shudder>) do the monitoring. It's the same thing that makes pingdom valuable.
yourabi 12y ago
Thanks for your feedback but I strongly disagree and I think recent history supports that CAs don't do much for you once they've collected your payment. CAs won't alert you if someone breaks into your server and replaces your certificate. They won't alert if you if you accidentally push a config change and start serving the wrong certificate to customers... And they certainly will not alert you if you are using a revoked certificate in production. I've bought multiple certificates from different reputable vendors - I only ever got one Heartbleed notice. (This pattern repeats itself) Many shops don't have a dedicated admin / webmaster auditing their certificates and even those that do have had public issues (Akamai, Apple, GitHub, Stripe...etc) The value in a service like Snitch is that we worry about your SSL certificates. Many people don't have the interest or time in rolling their home grown monitoring of this stuff...
- _asciiker_ 12y ago
  "CAs won't alert you if someone breaks into your server and replaces your certificate. They won't alert if you if you accidentally push a config change and start serving the wrong certificate to customers... And they certainly will not alert you if you are using a revoked certificate in production." You have valid points, my advice would be to make that part of the message as clear as possible. as a sys admin I could be a potential customer but then again, I already have to worry about certs I implement.
  - yourabi 12y ago
    Thank you for that feedback! It is very valuable to hear that I didn't message this effectively - I'll work on improving that. I'd love to chat more out-of-band - would you mind emailing me (this username at currylabs.com or gmail.com)
xyzzy123 12y ago
I let a RapidSSL cert lapse lately. They sent me 11 emails about it. They were really rather insistent: Early bird special: Renew your <website> to save Keep <website> Secure, renew your SSL Last chance to save: Your <website> is expiring ACTION REQUIRED: Your SSL needs attention FINAL NOTICE: Your SSL expires tomorrow LAST CHANCE: Your SSL expires today SECURITY ALERT: Your <website> may not be secure ACTION REQUIRED: Your SSL needs attention SSL EXPIRED: Renew to rescue CALL US: SSL for <website> is expired Your last SSL expiration notice for <website> I was actually relieved when they finally stopped mailing me...
- deleted 12y ago
  [deleted]

ianmcgowan 12y ago

Perhaps a non-problem for startups, but it's definitely a problem for bigger companies where the group that purchases certs may not be the one using them...

danielbln 12y ago
I would think that bigger companies would use dedicated IT staff over a start-up for something crucial like SSL cert checking.
- aroch 12y ago
  Given that Microsoft and Amazon have both had their SSL certs for their cloud businesses expire, a little extra reminding probably can't hurt. That said, I wouldn't pay for a service like this from a random person, I'd have my registrar do it (MarkMonitor or similar -- that's why they're paid the big bucks).
  - yourabi 12y ago
    Thanks for the feedback and thoughts, aroch. Can I ask why you wouldn't pay a "random person" as you say - since this information is by definition public? Can you tell me a bit about your experience using MarkMonitor to do this?
    - aroch 12y ago
      I don't see the value in paying someone and then trusting them with something (as you say) important to my business when they have no track record. For my personal set of servers (some 25-30, with ~50 SSL certs), I have Nagios for monitoring them plus calendar alerts, SMS alerts and sane cycling (everything expires in the same month). My employer is an intermediary CA, they can issue their own certs but I've worked with people who use Markmonitor. As part of buying your cert through them is they worry about making sure your domains stay protected. They'll call you, text you and even mail you reminders. And they have a proven track record dealing with companies that are collective worth trillions.
  - ianmcgowan 12y ago
    [Full disclosure - I've been beta testing snitch and been very happy with it]. In an old job for a mid-level bank, we had many behind the scenes (never showed up as a green padlock in any browser) integrations that would quit working when certs expired, frequently ones that we didn't purchase or control. At the time, it was definitely worth it to me to get some notice before that happened. And it can be easier to plonk down a credit card than work though internal processes to have nagios (or patrol express, <shudder>) do the monitoring. It's the same thing that makes pingdom valuable.

yourabi 12y ago

Thanks for your feedback but I strongly disagree and I think recent history supports that CAs don't do much for you once they've collected your payment. CAs won't alert you if someone breaks into your server and replaces your certificate. They won't alert if you if you accidentally push a config change and start serving the wrong certificate to customers... And they certainly will not alert you if you are using a revoked certificate in production. I've bought multiple certificates from different reputable vendors - I only ever got one Heartbleed notice. (This pattern repeats itself) Many shops don't have a dedicated admin / webmaster auditing their certificates and even those that do have had public issues (Akamai, Apple, GitHub, Stripe...etc) The value in a service like Snitch is that we worry about your SSL certificates. Many people don't have the interest or time in rolling their home grown monitoring of this stuff...

_asciiker_ 12y ago
"CAs won't alert you if someone breaks into your server and replaces your certificate. They won't alert if you if you accidentally push a config change and start serving the wrong certificate to customers... And they certainly will not alert you if you are using a revoked certificate in production." You have valid points, my advice would be to make that part of the message as clear as possible. as a sys admin I could be a potential customer but then again, I already have to worry about certs I implement.
- yourabi 12y ago
  Thank you for that feedback! It is very valuable to hear that I didn't message this effectively - I'll work on improving that. I'd love to chat more out-of-band - would you mind emailing me (this username at currylabs.com or gmail.com)

xyzzy123 12y ago

I let a RapidSSL cert lapse lately. They sent me 11 emails about it. They were really rather insistent: Early bird special: Renew your <website> to save Keep <website> Secure, renew your SSL Last chance to save: Your <website> is expiring ACTION REQUIRED: Your SSL needs attention FINAL NOTICE: Your SSL expires tomorrow LAST CHANCE: Your SSL expires today SECURITY ALERT: Your <website> may not be secure ACTION REQUIRED: Your SSL needs attention SSL EXPIRED: Renew to rescue CALL US: SSL for <website> is expired Your last SSL expiration notice for <website> I was actually relieved when they finally stopped mailing me...

deleted 12y ago
[deleted]