30 May
2020
30 May
'20
4:31 p.m.
Hi Everyone,
I'm stuck in a never-ending conference call at work because of
significant enterprise-wide outages. These outages have been caused by
apparently valid certificates failing to verify.
Our investigation has revealed that the AddTrust Root CA certificate
expired today but our certificate issuer sold us 2 year certs without
checking every cert in the chain of trust was valid until the expiry
date of the certs we bought (There was only 1 year remaining on the Root
CA cert on the day they sold us a 2 year cert signed with it.)
You may wish to check the chains of trust on your certificates...
All the best,
Paul.
30 May
30 May
4:44 p.m.
On 2020-05-30 17:31, Paul Stimpson wrote:
Hi Everyone,
I'm stuck in a never-ending conference call at work because of
significant enterprise-wide outages. These outages have been caused by
apparently valid certificates failing to verify.
Our investigation has revealed that the AddTrust Root CA certificate
expired today but our certificate issuer sold us 2 year certs without
checking every cert in the chain of trust was valid until the expiry
date of the certs we bought (There was only 1 year remaining on the
Root CA cert on the day they sold us a 2 year cert signed with it.)
You may wish to check the chains of trust on your certificates...
How many people would check all up the chain for expiry dates. End users
I mean, one would expect suppliers to
4:54 p.m.
Hello,
On Sat, May 30, 2020 at 05:44:04PM +0100, keith(a)keiths-place.co.uk wrote:
one would expect suppliers to
If the TLS industry were anything better than a cartel of snake oil
salespersons they would have moved to a Let's Encrypt model on their
own. The entire industry now exists solely to extract money from
owners of legacy equipment. Expect it to get worse!
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
5:31 p.m.
On 2020-05-30 17:54, Andy Smith wrote:
Hello,
On Sat, May 30, 2020 at 05:44:04PM +0100, keith(a)keiths-place.co.uk
wrote:
Yes, I didn't want to say that.
I have Let's Encrypt certificates and they just autorenew every 3
months. No hassle.
Keith
one would expect suppliers to
If the TLS industry were anything better than a cartel of snake oil
salespersons they would have moved to a Let's Encrypt model on their
own. The entire industry now exists solely to extract money from
owners of legacy equipment. Expect it to get worse! 
1 Jun
1 Jun
6 p.m.
Andy said:
If the TLS industry were anything better than a cartel
of snake oil
salespersons they would have moved to a Let's Encrypt model on their
own. The entire industry now exists solely to extract money from
owners of legacy equipment. Expect it to get worse!
Would we have Ubuntu if Mark Shuttleworth hadn't got far too much money
for selling Thwate?
Ian
6:56 p.m.
On Mon, 1 Jun 2020 19:00:54 +0100
Ian <ian(a)lovingboth.com> wrote:
Would we have Ubuntu if Mark Shuttleworth hadn't
got far too much
money for selling Thwate?
I remember people who'd been staunch Debian supporters selling out to
help create ubuntu. I'd come to Linux from OS/2 and had used distros
like redhat but once I'd been introduced to the Debian philosophy I was
hooked and have not used or wanted to use anything else for the last
30??? years. I have HantsLUG to thank for that.
I'm just a user, the closest I've been to writing a line of code has
been writing spreadsheet macros or designing websites from scratch.
There was a time when Debian had the reputation for being hard to setup
and use but that hasn't been true for years.
--
John Lewis
2 Jun
2 Jun
8:21 a.m.
On 2020-06-01 19:56+0100, john lewis wrote:
I remember people who'd been staunch Debian
supporters selling out to
help create ubuntu. I'd come to Linux from OS/2 and had used distros
like redhat but once I'd been introduced to the Debian philosophy I was
hooked and have not used or wanted to use anything else for the last
30??? years. I have HantsLUG to thank for that.
What parts of Debian philosophy stick out the best for you? For me it's
the attention to stability. Apt was also a strong selling point compared
to how easy it was to mess up RH.
I'm just a user, the closest I've been to
writing a line of code has
been writing spreadsheet macros or designing websites from scratch.
I think submitting good bug reports is a more vital part of the
ecosystem than writing code. It's easy to break things in code, so it's
very important to feedback/feedforward bugs and wish lists.
There was a time when Debian had the reputation for
being hard to
setup and use but that hasn't been true for years.
If things are getting to easy there's always Debian From Scratch :)
Ed
8:29 a.m.
On 02/06/2020 09:21, ed-bitfolk(a)s5h.net wrote:
I bootstrapped 64 bit Debian onto a Raspberry Pi 4 (8GB) yesterday, and
even that was worryingly easy.
The only slightly tricky bit was having a running system and realising
all the bits which aren't there by default, and then each time you just
type "apt install man-db", or similar.
John
--
Xronos Scheduler - https://xronos.uk/
All your school's schedule information in one place.
Timetable, activities, homework, public events - the lot
Live demo at https://schedulerdemo.xronos.uk/
On 2020-06-01 19:56+0100, john lewis wrote:
[snip]
There was a
time when Debian had the reputation for being hard to
setup and use but that hasn't been true for years.
If things are getting to easy there's always Debian From Scratch :)
10:48 a.m.
On Tue, 2 Jun 2020 09:29:41 +0100
John Winters <john(a)sinodun.org.uk> wrote:
On 02/06/2020 09:21, ed-bitfolk(a)s5h.net wrote:
I bootstrapped 64 bit Debian onto a Raspberry Pi 4 (8GB) yesterday,
and even that was worryingly easy.
The only slightly tricky bit was having a running system and
realising all the bits which aren't there by default, and then each
time you just type "apt install man-db", or similar.
I haven't managed to install Debian on the Mac-mini I was given as yet
or get it running on the EeePC I've had lying around for years. It
should run on that I think as it was bought with a linux distro
installed. I have been doing too much non-computer stuff lately to have
had time for playing.
Learning to use an iPhone6 has been one of the distractions, it is
an old one I was given so I could make use of the built in video-cam to
connect with family. I have been resisting getting a smart phone ever
since they came along but lockdown has made me re-think my opposition
to having/using one.
--
John Lewis
On 2020-06-01 19:56+0100, john lewis wrote:
[snip]
There was
a time when Debian had the reputation for being hard to
setup and use but that hasn't been true for years.
If things are getting to easy there's always Debian From Scratch :)
30 May
30 May
4:48 p.m.
https://www.agwa.name/blog/post/fixing_the_addtrust_root_expiration
appear to contains some good information.
// Andreas
4:49 p.m.
Hello,
On Sat, May 30, 2020 at 05:31:22PM +0100, Paul Stimpson wrote:
You may wish to check the chains of trust on your
certificates...
Nasty.
I would be interested in a Nagios/Icinga plugin that will test all
intermediate certs. We have the existing check_https but I believe
that only checks the validity of the endpoint certificate.
https://tools.bitfolk.com/wiki/Monitoring#Setup
As an aside, I am persuaded by the move to automated Let's
Encrypt-style certificates with short validity. Automatically
changing the certificate every 3 months seems more secure and
reliable than a 2 year cert which also offers more scope for humans
forgetting how to do something they only do manually once every 24
months.
Sadly it is not always possible what with the large range of devices
that use certs. Things that aren't "real hosts" like IPMI/BMC,
firewall and loadbalancer appliances for example, can restrict you
to a manual process.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
5:07 p.m.
Hi,
Sadly it is not always possible what with the large
range of devices
that use certs. Things that aren't "real hosts" like IPMI/BMC,
firewall and loadbalancer appliances for example, can restrict you
to a manual process.
You should be able to get a Lets Encrypt certificate for such devices, even
if they have private IP addresses, provided they have names in the Global
DNS.
The DNS-01 protocol (rather than HTTP-01) will allow you to prove the
ownership of those names with DNS records.
Then it's "just" a question of working out how to upload those certificates
in a more-or-less automated way to the devices themselves...
Best wishes,
@ndy
--
andyjpb(a)ashurst.eu.org
http://www.ashurst.eu.org/
0x7EBA75FF
5:25 p.m.
Hello,
On Sat, May 30, 2020 at 06:07:00PM +0100, Andy Bennett wrote:
Then it's "just" a question of working
out how to upload those certificates
in a more-or-less automated way to the devices themselves...
Yep that's mostly what I meant. These appliances often only have a
web interface that is hostile to automation.
Cheers,
Andy
1 Jun
1 Jun
7:30 p.m.
On Sat, 30 May 2020 at 18:07, Andy Bennett <andyjpb(a)ashurst.eu.org> wrote:
You should be able to get a Lets Encrypt certificate
for such devices,
even
if they have private IP addresses, provided they have names in the Global
DNS.
The DNS-01 protocol (rather than HTTP-01) will allow you to prove the
ownership of those names with DNS records.
Correct, but the CN on the cert doesn’t need to match a live record. Acme
DNS-01 uses a challenge TXT record to auth ownership, e.g. _
acme-challenge.example.com for an example.com cert.
I’ve provisioned loads of LE certs using DNS-01 before creating a DNS
record matching the CN.
-n
30 May
30 May
6:49 p.m.
On 2020-05-30 16:49+0000, Andy Smith wrote:
Hello,
On Sat, May 30, 2020 at 05:31:22PM +0100, Paul Stimpson wrote:
I seem to remember writing tests for something or other that used
openssl s_client -verify, which I think was a simple hack at the time.
Ed
You may wish to check the chains of trust on your
certificates...
Nasty.
I would be interested in a Nagios/Icinga plugin that will test all
intermediate certs. We have the existing check_https but I believe
that only checks the validity of the endpoint certificate.
1663
days inactive
1666
days old
14 comments
10 participants
participants (10)
-
Andreas Olsson -
Andy Bennett -
Andy Smith -
ed-bitfolk＠s5h.net -
Ian -
john lewis -
John Winters -
keith＠keiths-place.co.uk -
Paul Stimpson -
William Anderson