7 ms·

Expired SSL Certificate at GitHub

79 points by cloudc0de 3y ago

laund 3y ago
same for raw.githubusercontent.com which is images, raw text files etc. certificte validity end date: Tue, 21 Mar 2023 23:59:59 GMT
markuman123 3y ago
maybe the certificate crew is laid off?
cloudc0de 3y ago
Guess this will never stop happening
- chrbr 3y ago
  Whomst among us hasn't made the old "accidentally let the SSL cert expire" mistake?
  - bombcar 3y ago
    Caddy and the auto-issuing certs is the next step, but that is prone to failure, too, of a different kind.
    - VWWHFSfQ 3y ago
      Automated certificate issuing is a problem by itself. "The authority that issued my cert isn't the authority that I thought it was but it looks the same and works, so carry on" kind of thing.
- nickf 3y ago
  …and with more frequency in the future. 90 day certs are going to make it happen all the more often.
  - dymk 3y ago
    Make certs expire in 14 days and I bet this would never happen
  - moffkalast 3y ago
    I hope whoever thought of that gets a lot of angry emails every 90 days.
  - paxys 3y ago
    Disagree. Making certs expire more frequently will actually make the problem less likely to happen.
GOATS- 3y ago
Heh, just noticed this myself.
ksml 3y ago
They're serving the wrong cert on pkg-containers.githubusercontent.com (it's for *.githubassets.com) and their support site also expired 3/21... https://support.github.com/ https://support.github.com/ What is going on over there?
- JamesonNetworks 3y ago
  Layoffs?
deleted 3y ago
[deleted]
sweetroll 3y ago
Glad I'm not the only one. Getting the same when trying to wget a release - says failed to verify certificate for objects.githubusercontent.com
markuman123 3y ago
expired two days ago (3/22/2023) and no one cares
- laund 3y ago
  i think they added the wrong cert. it was working earlier today.
nayuki 3y ago
Not related but another GitHub issue today: https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-k... , https://news.ycombinator.com/item?id=35285390 https://news.ycombinator.com/item?id=35285390
dz0ny 3y ago
Looks like they tried to rotate the cert, maybe due to the private key leak. But instead, they rolled the wrong expired key to all content domains.
- AviationAtom 3y ago
  I'm more thinking the new host key prevented SSL cert rotation from happening properly
  - orra 3y ago
    Maybe, but only if they're refreshing certificates less than a day before expiry. Which isn't ideal.
laund 3y ago
FIXED!
ollemasle 3y ago
They just posted this update on GitHub Status - related to GitHub Pages: We are aware of TLS problems related to an expired certificate in our CDN configuration. We are working to resolve this issue. See https://www.githubstatus.com/incidents/x7njwb481j9b https://www.githubstatus.com/incidents/x7njwb481j9b
- ollemasle 3y ago
  And now (Mar 24, 2023 - 21:10 UTC): This incident has been resolved. This is indeed resolved.
flerchin 3y ago
It's better now.
crazysim 3y ago
They're not having a great Friday.
- AviationAtom 3y ago
  It does make me feel slightly less worse about the environment I have to maintain
deleted 3y ago
[deleted]
mattbillenstein 3y ago
I built a free monitoring service some years ago if anyone doesn't want to be the victim of this... https://ismycertexpired.com/check?domain=objects.githubusercontent.com https://ismycertexpired.com/check?domain=objects.githubuserc...
paxys 3y ago
How is it that literally nobody – whether deploying a hobby project or working at Microsoft or Google – has ever been able to figure out cert rotation? There's a billion dollar company waiting to be built if someone can just ensure that all my TLS certs across all servers will stay up to date for all eternity.
- guessmyname 3y ago
  > How is it that literally nobody – whether deploying a hobby project or working at Microsoft or Google – has ever been able to figure out cert rotation? There's a billion dollar company waiting to be built if someone can just ensure that all my TLS certs across all servers will stay up to date for all eternity. After doing SRE work for big companies, I have observed that many individuals, particularly young developers at well-known companies, are hesitant to ask for help for fear of appearing incompetent. Consequently, their mistakes may go unnoticed for extended periods of time, as is the case today. Unfortunately, even senior developers may make errors due to their egos. There is no comprehensive company-wide policy that can prevent individuals from being foolish or overconfident. When working for major corporations such as Microsoft or Google, one cannot expect to micromanage everyone constantly. One must trust that individuals will perform their duties to the best of their abilities. Let us accept that humans are not infallible, and that unintentional mistakes, such as this one, can and will occur. The key is to address these issues promptly and efficiently.
captn3m0 3y ago
I reported a expired certificate to DigitalOcean last week, it was for their package repository which meant apt-get would give warnings. These things happen. Was fixed in a hour.

79 points by cloudc0de 3y ago

same for raw.githubusercontent.com which is images, raw text files etc. certificte validity end date: Tue, 21 Mar 2023 23:59:59 GMT

markuman123 3y ago

maybe the certificate crew is laid off?

cloudc0de 3y ago

Guess this will never stop happening

chrbr 3y ago
Whomst among us hasn't made the old "accidentally let the SSL cert expire" mistake?
- bombcar 3y ago
  Caddy and the auto-issuing certs is the next step, but that is prone to failure, too, of a different kind.
  - VWWHFSfQ 3y ago
    Automated certificate issuing is a problem by itself. "The authority that issued my cert isn't the authority that I thought it was but it looks the same and works, so carry on" kind of thing.
nickf 3y ago
…and with more frequency in the future. 90 day certs are going to make it happen all the more often.
- dymk 3y ago
  Make certs expire in 14 days and I bet this would never happen
- moffkalast 3y ago
  I hope whoever thought of that gets a lot of angry emails every 90 days.
- paxys 3y ago
  Disagree. Making certs expire more frequently will actually make the problem less likely to happen.

GOATS- 3y ago

Heh, just noticed this myself.

ksml 3y ago

They're serving the wrong cert on pkg-containers.githubusercontent.com (it's for *.githubassets.com) and their support site also expired 3/21... https://support.github.com/ https://support.github.com/ What is going on over there?

JamesonNetworks 3y ago
Layoffs?

deleted 3y ago

[deleted]

sweetroll 3y ago

Glad I'm not the only one. Getting the same when trying to wget a release - says failed to verify certificate for objects.githubusercontent.com

markuman123 3y ago

expired two days ago (3/22/2023) and no one cares

laund 3y ago
i think they added the wrong cert. it was working earlier today.

nayuki 3y ago

Not related but another GitHub issue today: https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-k... , https://news.ycombinator.com/item?id=35285390 https://news.ycombinator.com/item?id=35285390

dz0ny 3y ago

Looks like they tried to rotate the cert, maybe due to the private key leak. But instead, they rolled the wrong expired key to all content domains.

AviationAtom 3y ago
I'm more thinking the new host key prevented SSL cert rotation from happening properly
- orra 3y ago
  Maybe, but only if they're refreshing certificates less than a day before expiry. Which isn't ideal.

laund 3y ago

FIXED!

ollemasle 3y ago

They just posted this update on GitHub Status - related to GitHub Pages: We are aware of TLS problems related to an expired certificate in our CDN configuration. We are working to resolve this issue. See https://www.githubstatus.com/incidents/x7njwb481j9b https://www.githubstatus.com/incidents/x7njwb481j9b

ollemasle 3y ago
And now (Mar 24, 2023 - 21:10 UTC): This incident has been resolved. This is indeed resolved.

flerchin 3y ago

It's better now.

crazysim 3y ago

They're not having a great Friday.

AviationAtom 3y ago
It does make me feel slightly less worse about the environment I have to maintain

deleted 3y ago

[deleted]

mattbillenstein 3y ago

I built a free monitoring service some years ago if anyone doesn't want to be the victim of this... https://ismycertexpired.com/check?domain=objects.githubusercontent.com https://ismycertexpired.com/check?domain=objects.githubuserc...

paxys 3y ago

How is it that literally nobody – whether deploying a hobby project or working at Microsoft or Google – has ever been able to figure out cert rotation? There's a billion dollar company waiting to be built if someone can just ensure that all my TLS certs across all servers will stay up to date for all eternity.

guessmyname 3y ago
> How is it that literally nobody – whether deploying a hobby project or working at Microsoft or Google – has ever been able to figure out cert rotation? There's a billion dollar company waiting to be built if someone can just ensure that all my TLS certs across all servers will stay up to date for all eternity. After doing SRE work for big companies, I have observed that many individuals, particularly young developers at well-known companies, are hesitant to ask for help for fear of appearing incompetent. Consequently, their mistakes may go unnoticed for extended periods of time, as is the case today. Unfortunately, even senior developers may make errors due to their egos. There is no comprehensive company-wide policy that can prevent individuals from being foolish or overconfident. When working for major corporations such as Microsoft or Google, one cannot expect to micromanage everyone constantly. One must trust that individuals will perform their duties to the best of their abilities. Let us accept that humans are not infallible, and that unintentional mistakes, such as this one, can and will occur. The key is to address these issues promptly and efficiently.

captn3m0 3y ago

I reported a expired certificate to DigitalOcean last week, it was for their package repository which meant apt-get would give warnings. These things happen. Was fixed in a hour.