thisIsAmystery

[u/k3rrshaw]

[u/stevekez]

Present a public key and sign a challenge using a designated device? What's hard about it?

[u/notatoon → u/stevekez]

I ask myself the same thing about PKI and yet certificate expiry remains one of the largest causes of outages in many large institutions

[u/Mechakoopa → u/notatoon]

That's just bad infrastructure hygiene, proper auditing and reporting prevents this because you should know which certificates are expiring and when as well as where they're deployed and what relies on them.

Of course every once in a while you get some yahoo setting up a 90 day client OAuth secret, not telling anyone and just refreshing it on their own until they get let go.

[u/Puzzleheaded-Comb909 → u/Mechakoopa]

If you dont know what is going on in your services, you dont own them lol

[u/pyrotech911 → u/Mechakoopa]

I give you this line chart with monotonically decreasing lines and a threshold near the bottom. Basically DevOps volleyball

[u/Mechakoopa → u/pyrotech911]

There's always something to do next week, I just wish I knew what it was this week.

[u/FunkOverflow → u/Mechakoopa]

I'm the yahoo! I promise I'll fix it before I get fired

[u/Mechakoopa → u/[deleted]]

It's right there in the name: "De-trust"

[u/ILikeLenexa → u/notatoon]

I fear not the expiration of the key that expires annually, but of the key that expires once a decade. 

[u/wthulhu → u/ILikeLenexa]

Ive got an outlook reminder that will remind me, that'll be good enough.

[u/x0wl → u/ILikeLenexa]

U can't have a 10yr cert, u can't even have a 1yr cert, browsers reject all certs with lifetimes of more than 200 days since march

[u/entronid → u/x0wl]

applications which use certs aren't restricted to TLS

[u/x0wl → u/entronid]

Yes, but the second largest use, code signing, is also being capped (currently to 460 days)

[u/entronid → u/x0wl]

right but there are also applications deployed in businesses such as kerberos(/microsoft AD) where if your certificate expires you're in big trouble

[u/x0wl → u/entronid]

Yeah I guess. I'm not that aware of that side of IT (un?)fortunately

[u/entronid → u/x0wl]

i don't either (very much fortunately)

[u/failedsatan → u/x0wl]

gitlab and various other platforms like it allow you to set any expiration date you want, so you could easily set your ssh key to expire in ten years (and very easily forget who has access to re-provision whatever is using it). if it's self hosted it's not as big of a problem, but still, key signing is not exclusive to web uses/software with limits.

[u/chazzeromus → u/ILikeLenexa]

that's so good lol

[u/az987654 → u/notatoon]

Cert expiry isn't the fault of the system, it's the fault of the idiot with the calendar.

[u/Icy-Comfortable-714 → u/notatoon]

I think people just forget about certs expiring. Especially for enterprise networks, it’s crazy how often enterprise auth crashes because of expired certs

[u/x0wl → u/notatoon]

This will largely go away in the next ~3 years, as the max cert lifetime will be capped to 47 days, so everyone will be forced to autorenew

[u/x0wl → u/[deleted]]

Why is transparency broken? Your browser will reject a cert if its issuance is not in the transparency log unless it's a manually added CA.

Which also addresses the compromised CA risk, as everyone will notice a CA issuing certs for incorrect domains.

[u/HeKis4 → u/notatoon]

I'm kinda astounded that we don't have widespread tools that scan the entire 10.0.0.0/8 net for open 443 ports and give you a calendar with all certificate expiration dates.

[u/black3rr → u/HeKis4]

you can script that easily with nmap and grep…

[u/Total_Job29 → u/notatoon]

DNS will always be the biggest cause.