News for hackers. Stuff that matters.

A comment on All extensions disabled due to expiration of intermediate signing cert. Parent comment

Re:All extensions disabled due to expiration of intermediate... by wbl on Friday May 03, 2019 @10:00PM (#19823825)
We scan our codebase for anything that looks like a cert and send emails when it gets close. Might not have helped here if it was an intermediate owned by a CA. There but for the grace of God go I.
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by lvh on Friday May 03, 2019 @11:53PM (#19824332)
If you want to get rid of those and they're public certs: odds are they're in Certificate Transparency logs and you can monitor them from there.
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by tialaramex on Saturday May 04, 2019 @03:56AM (#19825076)
Monitoring CT lets you verify that somebody renewed the certificate, but it doesn't verify they actually installed the replacement correctly.

My employer (Kynd.io) currently monitors public web sites for customers so we can flag e.g. "Hey this site cert expires in a week! If it's dead probably just switch it off, otherwise renew the certificate" and we're in the process of integrating CT but mostly so we can say "You already have a newer cert but need to go install it" in our How To Fix instructions.

[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by adtac on Friday May 03, 2019 @11:25PM (#19824231)
Why do you have certificates in your code to begin with?
[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by justinclift on Saturday May 04, 2019 @12:31AM (#19824457)
If you have your own CA for whatever reason, it's common to distribute the root and intermediate certs with your code so things can resolve.

You don't ship the signing keys with the certs, as that would be bad. ;)

[ Parent | on HN ]
Re:All extensions disabled due to expiration of intermediate... by justinclift on Saturday May 04, 2019 @11:26AM (#19827020)
s/resolve/validate/
[ Parent | on HN ]