Slashdot Mirror
Verisign Certificate Expiration Causes Multiple Problems
We had to do a little sleuthing today. Many readers wrote in with problems that turned out to be related. A certificate which Verisign used for signing SSL certificates has expired. When applications which depend on that certificate try to make an SSL connection, they fail and try to access crl.verisign.com, the certificate revocation list server. This has effectively DOS'ed that site, and Verisign has now updated the DNS record for that address to include several non-routable addresses, reducing the load on their servers. Some applications affected include older Internet Explorer browsers, Java, and Norton Antivirus (which may manifest itself as Microsoft Word being very slow to start). Hope this helps a few people, and if you have other apps with problems, please post about them below.
(which may manifest itself as Microsoft Word being very slow to start)
But.. I thought this SSL certificate expired just today..
Trolling is a art,
In an effort to have us forget about SiteFinder, they're going for an even bigger fuck-up.
Nice try, guys... now turn the CRL server back on.
There's software out there so anyone can sign a certificate. Who needs the suits at Verisign?
It's Christmas everyday with BitTorrent.
... ... ...
HUH!?!
And I thought I was a geek...
What the hell does that mean, what does it do, and who do we sue for the class action lawsuit?
"Life's funny sometimes." "And sometimes it isn't." --Cat's Cradle
Well, it's good to know that not only crackers or script kiddies are good at taking down Verisign's services, that their own staff is good at it too.
Do not look into laser with remaining eye.
Heh.
The Army reading list
hich may manifest itself as Microsoft Word being very slow to start
So I take it this has been a problem with Word for the past 10 years or so? Or did you mean "Microsoft Word being even SLOWER to start"?
Looking for hardware (Currently need: Large Etch-a-Sketch) Have one? See my journal!
that's kind of funny...i just checked my router logs right before coming here and noticed a request for crl.versign.com...thanks for the explanation before i even had a chance to ask!
Well thank answers a lot of questions.. My M$ Word has been working terribly, however I thought that was status quo..
Maybe if the slashdot editors did more of this regularly, then you would have less dupes, misleading stories, and spelling/grammar errors.
I hope this is a start of a trend.
SIG:Slashdot: indymedia for nerds.
saying that your certificate is expired or not yet valid...except that it is...you need to go here.
Do they run linux? j/k
Help Fight SPAM today!
"Many readers wrote in with problems..."
So Slashdot editors will give us tech-support too?
and if you have other apps with problems, please post about them below.
I can't get the DOS version of Duke Nukem to run in Windows XP. Is this at all somehow related? Is there a fix??
On one of our customers' systems (IIS). Turns out they had already installed the new Verisign intermediate certificate but had not removed the old one. IIS happily used the old one...
Lesson: if the certificate expired yesterday, remove it from IIS and then reboot the thing.
Ceci n'est pas une signature
Does nobody use DNS Round Robin?
StarWrite is breaking speed records.
which may manifest itself as Microsoft Word being very slow to start
Sounds like your Norton is functionally normally. Perhaps it may have been more accurate to say 'slower.' Or even 'slower than the interminably long slow you may be used to in a Norton product.'
In other news, Microsoft, Red Hat, Oracle, Sun, and Apple had to do a little coding today.
Rumors abound that Arnold Schwarzenegger had to do a little governing today, but these allegations remain unconfirmed at this time. More at eleven.
Obliteracy: Words with explosions
> if you have other apps with problems, please post about them below.
How 'bout if I just give you a link to Bugzilla?
Sheesh, evil *and* a jerk. -- Jade
I find it particularly disturbing that their solution to too much traffic to their CRL server is to use non-routable addresses in DNS. As a result of this action, they have reduced the integrity of their certificates (yes, that means diluting TRUST, which is the foundation of PKI) by making the revocation lists unavailable. Without CRL checking, Verisign certificates have no inherit integrity advantage over self-signed certificates. This is what we pay for?
Non-authoritative answer:
Name: crl.verisign.net
Addresses: 10.0.0.1, 10.0.0.2, 10.0.0.3, 64.94.110.11
198.49.161.200, 198.49.161.205, 198.49.161.206
Aliases: crl.verisign.com
Go figure.
I noticed the problem last night while paying my credit card bill online. Got a warning from IE that the site's certificate had expired. I was a little confused because the date for my CC company's cert was indeed valid. I thought it was just IE being stupid, but it makes sense now.
"I turn away with fright and horror from the lamentable evil of functions which do not have derivatives."
sPh
route the traffic to some "SiteFinder service"?
Error: Id10t detected
It is stupid for VeriSign not to have taken the steps necessary to keep their CRL available under these conditions seeing that they get paid a lot of money to do only 2 things:
1) Be trustworthy
2) Be competent
I had an SSL error last night while trying to access Extra's in the Play Online Browser used for Final Fantasy 11. I guess this could explain it.
Flame away, but what can I do about it? I heard from some people in my office that Word is running slow. (something about scanning for viruses). I assume it is because of Norton Antivirus (I don't specifically know what they are using out there). Is there something I have to do? Or am I stuck until Norton is fixed?
To KEEP the server down, you should have linked to it in the story. Hah!
(being anti-Verisign is still cool, rite guys?)
Setting the clock back a day will "fix" the problem until a more permanent solution is posted.
Well, not the Oracle database directly... But Oracle sent out a memo that certain Oracle products (Oracle Wallet Manager, in particular) would simply cease to function properly until the user upgraded their Verisign certificate(s).
I can't find ANY info on Oracle's website about this, though. The memo was sent to Oracle Premium Support customers but I don't know if the info has been generally distributed.
Woops!
I received the following email yesterday: Oracle Corporation has been notified by Sun that the set of VeriSign Class 2 and Class 3 Certificates used in Oracle products will be expiring on January 7, 2004. Please review MetaLink Doc 260332.1: Expiration of VeriSign Class 2/Class 3 Certificates on Jan 7,2004 for detail information.
...if you have other apps with problems, please post about them below.
Well, now that you mention it, my mother hasn't been able to print for a week, my uncle's PC keeps running checkdisk on startup, and I'm having trouble compiling kernel 2.6.0.
Oh yeah, and Unreal 2k3 has crappy frame rates on the 'Antalus' level, but maybe thats just my old ti4200 card.
Um. I think that's it for now. So when are you going to help me with these?
I'd rather be a conservative nutjob than a liberal with no nuts and no job.
If you have to upgrade and you're running Java on a Linux system that also runs RPM, why not head over to JPackage and download the spec for the 1.4.2_03 SDK? It would be a great opportunity to run an LSB compliant Java installation and support a fantastic open source project.
AOL IM has been acting really strange today, I'm not sure if it's related...
Unless you have a P75, I don't see what you are talking about. MSWord has always started in less that 3 seconds on my system (PIII 700) and I can tell you that sometimes it is terribly bloated (My system, not Word).
Wait, did I just admit running Windows on slashdot? Bye bye Karma.
Write boring code, not shiny code!
I use Instant SSL cheap, good service and I haven't seen any compatibility issues.
I did go there.... I don't have the line SSLCACertificateFile in my httpd.conf file... So, I'm afraid this page hasn't helped me much today. Should I have that directive in my conf file?
Because of the crl problems, Explorer has been acting slowly doing some seemingly unrelated activities. Copying or right-clicking on folders often is followed by a several second hang. To workaround, deselect "Check for publisher's certificate revocation" under the Advanced setting for IE (even though it is not IE running, that's where the setting should be changed). After this, no more Explorer hangs. Hope this helps someone. If you know why Explorer is checking crls for anything when doing a copy operation on files, please post.
We've purchased our SSL Certs from VeriSign for the last four years. We didn't recieve a single email from them EVER saying that our clients users (over 10,000 a day) might see this because of their cert expiring.
What a crock.
I hear that to get it to work with XP you need to upgrade to Duke Nukem Forever.
*ducks*
Not only that, but doesn't this open up a security whole? Someone could setup a fake server at one of those internal addresses.
If the CRL is no longer working, does this mean that my revoked certificates are still going to work?
I think it beats another new "helpful" feature like "CRL Finder."
Prevent email address forgery. Publish SPF records for y
I was helping a friend get setup last night to play Final Fantasy XI and he kept getting SSL failures when setting up an account. I couldn't figure out what the hell was wrong but this would explain it. You would think they would have dealt with this earlier. Seems alot of companies are getting caught unaware. Luckily we updated our webservers already last month when we got the letter.
Unroutable addresses? Anyone on private corporate networks which are large enough to use 10.0.0.0/8, who are unfortunate enough to have been allocated the IP addresses 10.0.0.{1,2,3}, may be experiencing a little more network load than usual today as every machine in the place tries to query them.
GROGGS: alive and well and living in
Very nice of them to.. I don't know.. let someone know before today. We spent a ton of staff time this morning trying to figure out why we could connect to our servers but not the payment engines via ssl. 4 hours later we figured it out.
= fs alert%2F57436n dors/exp-gsid-s sl.html
Couple of nice links.
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc
http://www.verisign.com/support/ve
Just three more hours seapeople and you can finally take me away from this crappy God Damned planet full of hippies
If you have enabled "Make this directory available off-line" in W2K or later, Windows will try to access the crl server whenever you delete a file... thus adding to the self-DDOS.
I tried it and things really sped up for me. This is one the reasons why I hang out here on /. - it's not for the abuse ... well, sometimes it is.
There is no spoon or sig.
Depending on how you have your server configured, it either means you are accepting revoked certificates, or are UNABLE to accept ANY certificates.
The default for some web servers is that if the CRL is unavailable, it will reject ALL presented certs.
This problem manifests itself through out the office suite; it definitly affects Excel 2003. It has also caused on my PC's problems with explorer.exe; i've also had a few issues with zone alarm.
lets hope they fix it swiftly; this is a _rather_ annoying problem.
Verisign, Inc: slashdotting the rest of the internet since 2003..."
~~~
"The slave thinks he is released from bondage, only to find a stronger set of chains" - NIN
Verisign has been sending their customers' notices for at least month telling them what was going to happen. I've personally helped four or five different people update their intermediate CAs over the past month. All of them had been notified by Verisign. Keep your info updated and before you file everything from Verisign as spam, at least look over it.
Hell,if the certs never expired, you people would complain about the security risk from the certs being valid too long. I call it the "Slashdot Effect".
------
"Don't like my answers? Then stop asking me questions."
I've been trying to figure out the cause of these weird problems all day.
Power off before disconnecting connecting connector. Seen on a cash register
We generate our own certs and provide a link on the opening web page for easy importation of the SSL certificate into the users web browser so future visits will be seemless.
Verisign is a complete waste of moeny, in 6 years of generating our own certs we never have had a problem, and users enjoy the benefit of SSL connections.
We saved thousands of dollars by "NOT" using Verisign and our customers have no complaints about importing a SSL certificate one time.
I noticed this earlier this morning, thanks for the information on the cause. Is there any word on a fix? Other than the obviouse dont use word/norton?
Jainith
Or is it merely that some software automatically calls the mothership for new information on expiration, and the hostname of the mothership happens to start with "crl"?
(Antidisclaimer: I operate five private CAs and delude myself that I basically understand this stuff.)
"But all your emitter and collector are belong to me!"
"Although VeriSign has been providing instructions on how to manually install
the new Global Server Intermediate Root CA to all GSID customers since
December, 2001, it is possible that some customers may not have noticed the
reminder and are unaware of this issue."
Or like me, it's a case of it was fixed (I know it was because I was the one that did it in early 2002) and now they are trying to figure how (and when) it got broken again....
That almost read like a real news story!
Non-authoritative answer: ...
Name: crl.verisign.net
Addresses: 10.0.0.1, 10.0.0.2, 10.0.0.3,
Aliases: crl.verisign.com
Damn! They're now trying to DoS my PC!
It is stupid for Microsoft not to have taken the steps necessary to keep thier OS from crashing seeing that they get paid a lot of money to do only 2 things:
1) Write good code
I can't get the DOS version of Duke Nukem to run in Windows XP. Is this at all somehow related? Is there a fix??
Actually, not a bad point... in a roundabout kind of way. Where does everyone go for help if they can't find a webpage discussing the problem they're having? Is there a very popular site, similar to Slashdot for helping people, particularly in a forum-like setting where people can post problems? Obviously, I know there are newsgroups and websites all over the place for this kind of thing, but is there one that's extremely popular? If not, I think Slashdot should start one...
For instance, I'm having a problem with Samba 3... I have pam_mount mounting user's home directories to a drive on a Windows server, but that doesn't let X Windows start because apparently certain files create hard-links, with SMB can't handle. So, what's a good way to work around it? I'm not sure what to search for, but nothing I've tried brings up anything really helpful.
"It's better to have a gun and not need it than need a gun and not have it." ~ Christian Slater, True Romance
how does one programatically add a CA cert to a browser?
No, but maybe a security half.
Probably. I would probably use SSLCertificateChain instead, but the difference is very slight.
m l ) for more info.
Your SSL directives might be included in ssl.conf; that's the way apache 2.x works.
Checkout the variety of resources available (www.modssl.org, http://httpd.apache.org/docs-2.0/ssl/ssl_howto.ht
- Not fuck up,
- Not fuck me over
But don't let it go to your head, l33t_d00d, that says more about them than you.the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
no problem at all. slow? perhaps compared to the bullinding 'speed' of unprecedented evile et AL?
You still trust VeriSign? Where the hell have you been for the past five years?
Does _everything_ have to be some pathetic jab at Microsoft? I mean, I can just hear the nerdlinger guffawing over this idiocy now.
its called ask.slashdot
Problems I've had with two w2k machines include; Explorer running slowly (right click and Cntl-X), Outlook running slowly, Word running slowly.
/.!! :)
The Advanced Internet Explorer settings fix mentioned earlier fit the bill and both are running normally now. Thanks
I'm guessing that this Denial of Service effect is largely due to the known scalability problems with X.509 CRLs. In a mature Public Key Infrastructure (PKI), about 1 in 6 certificates is revoked. A CRL is around 20-30 bytes in length for every revoked certificate.
That means that if you've issued 250,000 certificates, you can expect to have a CRL of about 1MB.
This aggregate information isn't bad for some back-end processing, but when a lot of clients try to grab the CRL, you can quickly saturate even a high-end 100Mbps hosted server farm.
Virtually every serious large-scale PKI (including VeriSign and Microsoft) is moving to OCSP to replace CRLs since each client will retrieve ~1kB per status request rather than a full 1MB CRL.
not for the won-eyed girl, or robbIE, but the plight of the lonely hobbyist has not been addressed/worsens with each failed request for personal .coNTact?
they do this to get even more phonIE monIE? is too much never enough for these corepirate nazi bootlickers/pr0n puppets?
It turns out I had to add that intermediate.crt file and that config directive into Apache 1.3.27 and it works now that I put that stuff in with the virtual host information.
You honestly think M$ get paid to write good code?
Karma: It's all a bunch of tree-huggin' hippy crap!
You call the Verisign guy, and he tells you what to do. I'm not sure why the instructions aren't on the page - just call.
Let's not stir that bag of worms...
There is a file in the JDK called cacerts.
(find . -name cacerts is your friend), this contains the certificates Java uses when initiating ssl connections.
As of yesterday Sun was still shipping java with the expired 3a certificate.
The way to include the new 3a certificate is to use the keytool command.
The format is somthing like: keytool -v -keystore cacerts -import newcert.pem
The default password for java's cacerts file is "changeit"
VC
ps how many geek points do i get for fixing this last week?
Official GOD FAQ.
I think it beats another new "helpful" feature like "CRL Finder."
Shite Finder.
The price of freedom is eternal litigation.
This vaguely reminds me of the fraudulent Verisign / Microsoft code-signing digital certificates that Verisign issued a few years back.
While not an identical problem, an essential element of why those certificates were potentially harmful was also because of a problem with the CRL checking. Verisign didn't support CRL distribution points in their certificates and you all remember the problems that ensued.
I found security researcher Gene Spafford's comments on the PKI / Verisign issue interesting, which were picked up in Bruce Schneier's Crypto-Gram. Schneier's comments on the incident as well as the Microsoft response are also worth reading.
It's unbelievable that Verisign which claims to be in the business of Internet security and SSL/TLS digital certificates - the dominant company with 95%+ market share - could let their Root Certificate Authority expire, then force its users to effectively patch their systems by importing the new certificate for the root CA after the fact. That's just bad engineering.
Yes, end-users need to take some responsibility for their systems, but PKI and related technologies are complex and not for novices. It's no better than the keep-your patches-updated-and-use-a-firewall comment that Bill Gates made a couple of months ago. That's a bandage, not a solution.
Just FYI
"Nothing is impossible for the man who refuses to listen to reason"
Yeah, that's what I thought. I tried sending mail to hostmaster@verisign.net because I thought the non-routability was itself a problem. It bounced - as did mail to hostmaster@verisign.com.
You should use one of Verisign's competitors. Thawte, for example. They couldn't be any more incompetently run than Verisign, surely.
Hail Eris, full of mischief...
E pluribus sanguinem
Well, after all, I should not be surprised to hear that, after the wildcard affair. They are definitely the masters for messing their DNS...
This completely kills IBM's Apache variant we've been down for most of the day working on this problem.
updated to reflect real world:
[root@kjell root]# host crl.verisign.net
crl.verisign.net has address 198.49.161.206
crl.verisign.net has address 198.49.161.200
crl.verisign.net has address 198.49.161.201
crl.verisign.net has address 198.49.161.202
crl.verisign.net has address 198.49.161.205
as of
serial = 2004010701
Thu Jan 8 23:17:57 CET 2004
note the 01 in 2004010701
-- for undocumented cisco commands, take a peek @ dotu
Except for the fact that Verisign owns Thawte.
Can this problem also affect Word, Excell and Outlook? One of our client called this morning to report slower-than-normal applications. And their problems had nothing to do with the server, which was apparently running fine...
Is it somehow related to Verisign's expired certificate?
You are more than the sum of what you consume. Desire is not an occupation.
my broker uses a java based platform, and it was quite
they mystery this morning why those using SSL couldn't log in!
We run Apache 1.3.22 and had to add the SSLCertificateChanFile directive in each virtual server. This was the only way to get Internet Explorer to update the Intermediate Cert the way it was supposed to.
I started up my box today, which has never given me any major trouble, only to find that it froze up for about five minutes or more after XP had started. I figured that maybe it was related to some system settings I altered last night after my usual weekly maintenance routine, so I changed the settings back, and rebooted. Again, I had the same problem - the system was just hanging for absolutely no reason.
:D
I then tried to get online to see if there were any patches I needed for any software or whatever (it didn't seem beyond the realms of possibility), only to find that ZoneAlarm had been messed up completely, and had forgotten all my stored settings, etcetera (it completely freaked out when I tried to connect, and upon closer inspection, the allowed program list, and everything else, was empty and/or back to it's default settings). I cancelled my attempt to connect, and ended up having to uninstall and re-install ZoneAlarm. The hanging-at-startup remained after a reboot, and during the long, not-usually-there pause, the thought occurred to me that perhaps it was the other constantly-running app I use, Norton AV, that was the problem, though after investigating, I couldn't seem to fix it. Eventually I was able to get online again, and ran LiveUpdate. Of course, after downloading and installing the updates available, this required a reboot, but everything was fine after that (although admittedly, my system does seem to hang for a few moments after right-clicking folders and such at the moment, even whilst offline).
So, yeah, ZoneAlarm and Norton AV were both affected by this badly. Oh, and for some bizarre reason, WinAmp popped up that window that asks for your e-mail address just after installation, having apparently forgotten that it's been installed since September. O_o;;
It's good to know that it's not a problem on my end, though, and that it's just a VeriSign messup.
Sure, it easy to compare VeriSign with the Vogons, but in all fairness, the Sirius Cybernetics Corporation fits them better.
Not to mention they're a bunch of mindless jerks who will be the first against the wall when the revolution comes.
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-U
We had 2 applications blow up last night at 6PM when the certificate expired and we had 7 more that were down this morning when users tried logging in. The funny thing was that my group manages our reverse proxy environment and all but one of our production certificates had been updated with the proper certificate chain. Once we had determined the problem we were able to resolve it quickly on our end. But, many of the applications that appeared to be accessible from the login page would not function once a valid user logged in.
99% of our problems have been related to backend webservers with out of date certificates or applications that used SSL between components that were still using the old certificate.
Let's be honest. Who here trusts Verisign? If you trusted them before, do you trust them now?
All this whole ordeal seems to have shown is that Verisign (or in general SSL's) method of verification and validation is completely unscaleable.
Why don't we use a loose-knit network of trust like GPG? We could still have root certificates which are ultimately trusted if the user wants, but would be able to set up little isolated trust networks which wouldn't be crippled by this sort of stupidity.
Karma: It's all a bunch of tree-huggin' hippy crap!
I see the same problem with Windows Explorer, which began sometime yesterday. There is a 5-10 second delay when right-clicking on a file in File Explorer.
First, it's ridiculous that such a widely used certificate was allowed to expire.
Second, it's even more ridiculous that right clicking on a file in File Explorer requires a certificate.
So what is the fix for this (besides switching to linux)?
Dan East
Better known as 318230.
Thanks!
Once again, if my boss ever inquires about the excessive HTTP requests to slashdot.org I've got a perfect justification.
This little tidbit solves a QA issue we've been scratching our heads on all day. Surf for 1 hour, save 1 day. Hey, does that mean I should read Slashdot full-time? :)
-Malloc___________________ I want to be free()!
beTRUSTed, which recently purchased Baltimore's CyberTrust and OmniRoot businesses. I used Baltimore's certs all the time to avoid VeriSign.
Digital Signature Trust, a subsidiary of Identrus. I've used their TrustID certs to avoid giving money to VeriSign as well.
Both of the above certificate authorities have their roots in the most current IE and Netscape/Mozilla browsers. Digital Signature Trust does a lot of stuff with banks (being owned by Identrus, which was created by a bunch of banks).
At work, we had two impacts from this problem.
1. First, we noticed a couple of months ago that another, lesser-used intermediate certificate expired for a test server, and this led us to check all of them, including the one everyone else is hating today. We had ours fixed months ago by updating the keystore out Java applications use.
2. We had people we connect to complaining OUR intermediate certificate had expired, when in fact, the intermediate certificates on their server used to verify ours had actually expired. If I recall, one of the other products impacted today was the IBM HTTPD server -- based on Apache, right?
CRLs are an example of a system that does not scale well. It's only recently become a problem because Windows is now actually checking the CRL to see if the certificate is expired. Verisign is at the mercy of the Internet because of a poorly designed system and flawed pricing model left over from good old days on the tech boom.
Sorry that I've posted anonymously but I want to keep my job.
He knew how to turn a phrase didn't he.
Yay me!
You need something that will auto-renew your certificates. IMCentric has a good solution.
www.imcentric.com
Isn't that implemented in W2000: CA, enrollment, and everything ?
I thought Verisign thought of themselves as an International company? Based on the '1/7/2004' date their page mentioned several times, this date here in Britain reads "first of the seventh month, 2004" which is no problem to us :)
If you're an International company, please stick to international conventions, such as 'YYYY-MM-DD HH:MM:SS GMT' even if only to say to the world, "hey I'm not one of those Americans who cannot recognise anyone else in the world!"
Updating your copy of Norton AntiVirus using the first link on this page fixes all associated problems: http://securityresponse.symantec.com/avcenter/down load/pages/US-N95.html
falcontx
I'm having a hard time with Norton Antivirus for the very same problem. Anyone knows a fix for this? Thanks
I work at a CNC machine shop and the app that sends programs to the machine broke today because of that. I would have never heard about it if it wasn't for my brother in law, who works for a company running the same application.
The fix was as follows: Open Internet Options, click Advanced tab. Under Security turn off both Check for Server Certificate Revocation and Check for Publisher Certificate Revocation. I think this fix should work for other apps that are affected by the same problem...Thought I'd pass it along.
On a side note, it's pretty scary that this has happened to begin with. What I had to go though was pretty minor since the problem was on one machine, but what about an entire enterprise with an app installed on 1000's of computers that were broken because of this? Because of all this ridiculous "signed app" nonsense, not only are you down, but through proxy Microsoft made you dependant on one of the biggest bastardized companies I know...Verisign. Don't expect this problem to fix itself in a timely manner.
If this is a sign of things to come, Palladium will bring Hell on earth.
-R
I know of many companies that offer signed SSL certs for much, much cheaper than VeriSign. In my mind, VeriSign isn't any more "trusted" than anyone else. This is similar to how before 1999, you had no choice but to get your domain registrations at Network Solutions (a VeriSign company, I think). But yet, people still pay 35 bucks a year for them for no good reason. Same with SSL certs. I think I found a signed cert for $25 a year at one time. (I hate VeriSign)
Domain name registration for $8.79 per year
879domains.co
Yeah our HR applicatons would fail on logins every once and awhile.. Course our IT support people are idgits and I only figured out the issue when I came home to get some messages from friends about their website SSL certs failing and then looked at my RSS bar and Slashdot gave me the answer!
*(#$ Verisign.. Nuff said.
>> I hear that to get it to work with XP you need
>> to upgrade to Duke Nukem Forever.
It's just called Duke Nukem now. It was a misquote from a developer Q&A session, the 'Forever' was referring to the ETA until release.
Sure, but if the machine you're attacking is on your local network, it would be easier and more efficient to hijack DNS altogether instead of relying on Verisign to provide one of the 10.0.0.* addresses for themselves. Direct all local traffic meant to go to Verisign to your own box and do whatever it was you were going to do without hoping for the 3 in 7 chance any given machine will hit your box when trying to update.
Don't blame me; I'm never given mod points.
I would love to see the Federal Trade Commission start granting digital certificates for little or no cost. Governments are already responsible for public security, and for granting identification documents such as social security cards and drivers' licenses, and for communications services such as running the postal service and opperating the Do Not Call Registry... why don't they do these things in the digital realm as well?
Mind you, I'm not calling for government regulation of the Internet... and certainly there is no way that government certificates should be in any way a requirement for opperating a secure website. There must still be commercial options available - and I'm sure they would become a lot more reasonably priced in the face of public competition. But if govenments are going to start taxing the Net (which they will), then certifying SSL certificates is the kind of service that they should be giving people in return.
SpyDock: Scientific Python in a Docker container
Without CRL checking, Verisign certificates have no inherit integrity advantage over self-signed certificates.
Nonsense. This would only affect the integrity of certificates which were stolen.
I didn't realize how far this went until I read this article. This morning about quarter til 8AM (Mountain Time) my wife and I were arriving at work, and she got a page saying that our global distribution software program (price quotes, placing orders, etc.) was inaccesible because some certificate had expired. None of our distributors could log in to our system through https. I thought it was some kind of security thing related to us, rather than "web-wide".
This sounds like the MS failure to renew DNS registration thing.
We may experience some slight turbulence and then...explode. -Capt. Mal Reynolds
Wouldn't have been so bad if it was just my company, but folks from other companies, friends of friends, political buddies of friends of friends...
No,
crl.verisign.net has address 198.49.161.200
crl.verisign.net has address 198.49.161.201
crl.verisign.net has address 198.49.161.202
crl.verisign.net has address 198.49.161.205
crl.verisign.net has address 198.49.161.206
crl.verisign.net has address 64.94.110.11
serial 2004010808
I should add that the oddball, 64.94.110.11, is the SiteFinder server. I guess they had some spare bandwidth kicking around there.
What a bunch of clowns.
OK, I'm not sure what slashdot means by junk characters, but hopefully these will balance them out.
I think they changed that to MS Bob Nukem (and his sidekick Kid Klippy!)
We may experience some slight turbulence and then...explode. -Capt. Mal Reynolds
I discovered this today, as a SOAP application I was working on stopped connecting. The strange thing was, both Mozilla and IE 6 could connect fine. So why did this only affect older versions of IE, and not newer ones? Why not Mozilla? Were these "fixed" to ignore expiry dates on CA certificates? It doesn't seem like a sensible thing to fix to me.
If you find yourself constantly reinstalling due to spyware and them clicking "yes" just install spybot search and destroy, update it, and use the Immunize feature, its great and will save you on a lot of the re-loads!
http://jonof.edgenetwork.org/buildport/duke3d/
-Native Windows port using my Build engine port.
-OpenGL rendering support.
-MIDI playback and authentic sound mixing using ported Apogee Sound System code.
Experimental UDP-based multiplayer.
-much more!
A certificate is so named, because the signer has CERTIFIED the holder to be trustworthy.
...] so if one of them says he's confirmed Joe Bloggs' identity, that's good enough for me; (full trust)
You'd think so, wouldn't you? Unfortunately for the sanity of anyone using a certificate architecture, you're wrong.
The certificates issued by Verisign and other Certifying Authorities are more "proof of ID" than anything else; the CA makes no assertions about the trustworthiness of the owner, they just assert that the public encryption key you've just been sent belongs to the same people who own the server you're connecting to.
A typical CA certificate as used in SSL, translated into English:
"We hereby certify that the following RSA key [...] belongs to the owner of shopping.example.com. Signed, Verisign."
When your browser connects to https://shopping.example.com, the server sends you its certificate, and the browser checks Verisign's signature on that certificate. If the server proceeds to steal your credit card number, subscribe you to undesirable mailing lists, etc., that's between you and example.com; it's only Verisign's fault if it turns out they issued a wrong certificate.
PGP uses the same principle: when you sign someone else's key, the statement you're "signing" is something like this:
"The following public encryption key [...] belongs to Joe Bloggs ; I have met Joe and verified the photo on his passport. Signed, pclminion."
GnuPG (and probably PGP) never talks about certificates, only about signatures.
If that certificate is later used to commit a felony, say, credit card fraud, then YOU could be held legally liable, because YOU CERTIFIED that this guy was trustworthy. You were negligent in failing to find out that he wasn't.
The only way you could be held responsible is if it turns out that you were so sloppy about checking Joe Bloggs' ID that you were actually negligent; (i.e. didn't check it at all, or accepted an obviously fake form of ID, or something); in most jurisdictions digital signatures aren't legally binding anyway.
Anyway, this is what the trust mechanism in PGP is for.
[Digression: You can build up a "web of trust" by saying things like:
- I trust [... some people
- these other people: [...] I don't trust so much, but if three different people all say they've confirmed Joe's identity, I'll believe that they're not all conspiring against me, so that's OK too; (partial trust)
- everyone else either I don't know, or I know but don't trust, so I'll ignore what they say when I make my decisions.
(These trust values are a private decision, there's no reason to reveal them to the world.)
end digression]
If you incorrectly sign someone's key, and a third party gets hurt as a result, you could easily argue that it's that third party's fault for trusting your opinion.
Incidentally, you can emulate the "certifying authority" model in PGP by giving full trust to Verisign, Thawte et al, and no trust to anyone else. This is a painfully limiting model compared with the full web of trust, though; to me it looks as though the whole mechanism was designed to make money for certifying authorities.
I'm seeing some mail stuck in queue on our SMTP server due to remote "TLS handshake failed".
We've been using TLS with sendmail for 1.5 years, and this is the first time I've ever seen this error.
Remote server seems to be using some MS mail server (Exchange?):
Nothing to see here; Move along.
One of the main tools I use is CSG's ACSR, which I run over a Citrix session.
I was unable to log in initally yesterday because the SSL certificate had expired, it seemed.
Setting the date back on my station seemed to fix the problem though!
Oh Jesus, where do I start?
Hmm.. Let's complain about scary popups. I mean... They're SCARY! Nothing like a scary popup to crap all over a nicely sanitized Internet experience.
Ok then, let's talk about these pre-installed SSL certs. How many of you have taken the time to realize that an installed certificate is supposed to mean that YOU have PERSONALLY VERIFIED at least the cert's thumbprint. Did you install those certs in your browser? No. What does that tell you? Someone else (Microsoft) declared the keys to be valid. Was the installer for the browser digitally signed by a key verified by you? No. Should I go on?
Well then, let's talk about the expiration dates on those certs. I know I feel safer with certs that don't expire until 2020. I mean, what if those darned scary popups started poppin up all over the place. What would we do? Nevermind the fact that this SSL crap uses RSA encryption. Any PGP-heads want to weigh in on how long keys of any kind should be allowed to live? There's the strength of the key in numbers of bits to consider because it determines how "strong" it is to resist being broken. Then there's the simple fact that the length of time that key exists in valid form is the lenght of time someone can use to steal it.
Look, if you have cajones you will de-install ALL your root certs from your browser and re-install them, actually reading the scary popup that comes up showing the thumbprint of the cert asking you ARE YOU SURE THIS IS A VALID CERT? At least then you can't say you didn't know. To help with this, a few years ago someone created a printed book with a copy of all the root certs available at the time. I suggest getting a copy.
Or your accepting a a cert from 10.0.0.1 which I would assume is on your internal network.
I have walked a user through performing the following procedure, and she has reported success with her two machines. She is running Windows 2000 Pro with Office 2000 and NAV 2003 (only 99% sure about the last one).
:P
- goto http://windowsupdate.microsoft.com/
- click Scan for Updates link (may be prompted to accept the ActiveX thing)
- Navigate to the page of non-critical updates (ironic, no?)
- Find the update named something like "Root Certificate Update" or "Root Certificate Authority" (can't remember which)
- Install it
- rejoice at the ability to use MS Word again
Keyboard not found.
Press F1 to continue.
Unfortunately, unless you buy a cert from one of the officially blessed cert authorities, your users get this ugly-looking "security warning" popup from their browser. While this is fine for clued individuals, or internal sites and so on, things that are public-facing are more sensitive to that sort of thing.
It galls me every time I have to give someone on the officially "blessed CA" list money to do something I can do for myself in less time, but I don't know of an alternative that allows the public users of a secure website to not get alarming messages on their browser when they try to give us money.
The public at large don't understand seriousness of the dialog box security alert, so they don't want to see it. How do you get rid of it ? You get your Certs signed by Verisign or some other CA your browser automatically trusts. So you aren't paying Verisign or another CA because you trust them, you are paying them to get rid of an annoying dialog box, and that is all.
I call that money for jam.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
The specific errors you are getting probably depend upon your architecture, but this is the first place I'd look. Our errors were obvious "cert expired" ones. The "non-routable" message is likely realted to the Verisign dumbasses using some non-routable addresses as described in other posts and if you FTFA.m ID=17&threadID=46299&tstart=0
Here's the link from Citrix : http://support.citrix.com/forums/thread.jspa?foru
To summarize:
Any ICA connections that use Secure Gateway or SSL Relay will be affected. The solution is to replace your outdated intermediate certificate on all Secure Gateway servers, web servers and any MetaFrame servers running the SSL Relay service.
The error you get when trying to connect might look something like this:
The connection was rejected. The SSL certificate is no longer valid. Please contact your Citrix Administrator (SSL error 70)
Or this:
The server sent an expired security certificate. The certificate "O=Verisign Trust Network, OU=VeriSign, Inc., OU=VeriSign International Server CA - Class 3, OU=www.verisign.com/CPS Incorb.by Ref. LIABILITY LTD.(c)97 VeriSign" is valid from Thursday, April 17, 1997 to Wednesday, January 7, 2004.
Good luck
"Nothing is impossible for the man who refuses to listen to reason"
Steam is down (for counter-strike)
Hell, probably like us, there were piles of customers who assumed that their software vendors would have resolved any such problems regarding such old Verisign certs ages ago - or at least notified us in advance how to fix the issue. Naw - let the users deal with crapped out servers on their own (Howdy SYBASE ...!).
Verisign did indeed provide some instructions on their web site for a limited number of server applications and old web browsers. However, it was hardly a universal or comprehensive solution.
Fixed the messenger problem on my own system after reading about this. Turning off the revoc check lets messenger log in again.
If are helping some other lame Windows user like me that is having problems with Messenger, try turning off the revoc check in IE.
we did, luckily i caught it early enough, found the solution (updating to java 1.4.2_03 in our case), and updated live servers before too many transactions got fucked.
would have been nice if Sun and/or Verisign has told anyone about this in advance.
sure they put out the java release a couple of weeks ago, but only with a miniscule release note:
bug #4924896
Ship currently published CA certificates in cacerts file."
it should have had a big fat warning like "UPGRADE NOW OR YOUR SITE WILL BREAK ON JAN 7th!"
bastards.
This is the real truth. Those that are technically inclined will be OK with self-signed certs, knowing that verislime is evil anyhow. Those that aren't in the know will eventually click OK just to get where they want.
Seriously though, why do we need a central point for signing certs, at $100 a pop what dangers are there in self-signed ones? SSL isn't just for money transactions anymore, and even a company with a verislime signed cert could be less than legit.
Everybody who is using these certificates has time to update them to new ones. There were alerts few weeks ago about expiration.
slashdot guys are probably not in the bussiness not to know about it before and having troubles now.
Yeah, I understand, you hardly can help your Norton antivirus, but it's job for the company to make an update and inform customers. If they didn't do it, blame them, not Verisign.
Yeah, I understand for the 2nd time, you can blame Verisign for making crapy DNS records.
in stead of finding the solution myself...
/. BEFORE it expired...
and if you have other apps with problems, please post about them below.
Got one.
We've got a stand-alone java app using a client-side certificate for athentication to get some XML over https from an webserver. It's very unfortunate that our client certificate has been signed by a certificate that was itself signed before august 2002 (the moment verisign started to sign with a new cert). To be precise 1.5 month before august 2002.
Our app stopped working yesterday 45 minutes into the new day. (It runs every 15 minutes, so the first 2 or three times it still succeeded).
We have had some bad experiences with the party that owns the said webserver (changing XML specs without notice breaking our XSD's and such), so my first responce was calling them (again).
After a couple of hours they responded with the "solution" that I should reconnect with the internet explorer installed on the server that runs our application and all should be fine again. I knew it wouldn't help because our application knows nothing about IE, but tried it and every suggestion they gave after that.
In the end they send the Intermediate Root CA in a file to us witch I imported into the default java root-CA keystore (using keytool). This fixed the problem.
I really hessitated to import something into the default keystore but it seemed the last solution I could try.
Now I read slashdot and the sun alert accompanying the article, it turns out my solution was about the only right one to use.
The application was down for more than a day.
Now I think about it.... Verisign knows the email addresses of every customer they send a certificate to, signed by this expired certificate.
In fact they know which one's were signed to be used AFTER their's would expire!
Would it have been such a problem to send these persons a warning email in stead of relying on a warning on some page of their website?
I think I wouln't have disgarded a verisign email with the subject WARNING, your certificate is about to return expiration warnings! or something like that as beeing spam.
Offcourse sending people a warning email fails to address everyone, but it sure would have triggered more response than the method they used now.
Maybe it would even had made it onto
Just a thought.
Robby2
Friends don't help friends install M$ junk.
we encountered yesterday (Jan. 8) also SSL problems while trying up2date with RHN re. kernel 2.4.20-24.9
This is the company with a network support engineer who asked me "What is telnet?" during a support call .... Needless to say, I fixed the problem myself without the benefit of their "professional assistance".
There will be much more idiocy coming from Verisign in the forthcoming years, I would bet. It's a company staffed with dumb (ie. probably just underpaid) semi-tech people and driven by clueless marketeers and accountants who lack the ability and commonsense to distinguish good ideas from extremely dumb ones.
First - thanks for letting me know what happened!
For me, the trouble was NAV intercepting all my right-clicks.
But the thing I don't understand, is:
I packet-monitored what happened, so I saw that my PC connected to http://64.94.110.11/
This was the "conversation":
My PC: /Class3SoftwarePublishers.crl HTTP/1.1t : crl.verisign.com
GET
Accept: */*
User-Agent: CryptRetrieveObjectByUrl::InetSchemeProvider
Hos
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: v1st=3E9B2224FB5AAB53
VeriSign CRL:
HTTP/1.1 200 OK
Date: Thu, 08 Jan 2004 23:23:05 GMT
Server: Apache
Last-Modified: Thu, 08 Jan 2004 16:18:40 GMT
ETag: "ac04-192-3ffd82e0"
Accept-Ranges: bytes
Content-Length: 402
Connection: close
Content-Type: text/plain
0Z0o0 *H/ 0E10U VeriSign, Inc.10UVeriSign Trust Network1F0DU=www.verisign.com/repository/RPA Incorp. by Ref.,LIAB.LTD(c)981D0BU;VeriSign Class 3 CA - Commercial Content/Software Publisher 040106000000Z 040409235959Z0 *H/ eSY}u"Wfb`C($Vu;m-v9ufO)uOwZ'A'o?(UI/|
___________________________________________
I right-clicked once more, and checked also *that* "conversation" - and it was the same, apart from the timestamps.
So - apparently that CRL server was not *completly* DOS'ed - altough it tokk 5-10 seconds before the reply came.
Why did my PC need to download that SAME *.crl - Class3SoftwarePublishers.crl - so MANY times???
I also - for fun - downloaded all the 51 *.crl's on that server, *manually*, to look at them. (Until yesterday, I had no idea what a *.crl was)
And I did get all those 2.57MB downloaded, although it took some minutes. So, I'm 100% sure that CRL server was not *completly* DOS'ed.
Or have I misunderstood it all! Was the http://64.94.110.11/ site maybe the VeriSign "fix"? If so - then I apologize for being so stupid. But still, my 1st question remains:
Why the numerous downloads of the SAME file?
With regards,
Clokkevi.
Actually, VeriSign sent out an e-mail notice of the CA expiration in January 2002 (which addressed the Root CA expiration), added text in their certificate approval e-mails, and sent a reminder e-mail in December 2003 (which specifically addressed the Intermediate CA expiration.) It probably didn't reach every customer though due to changes in e-mail addresses, some people probably deleted it without reading it, and some of those that did read it may not have understood what issues they would see when the CAs expired.
Below is what was in the January 2002 e-mail (yes, I am a packrat.)
Global Server IDs with IE 4.0 browsers
Rev 3.0
January 21, 2002
Summary of Issue
Any organization with a newly issued Global Server ID can not enable customers using IE 4.0 to connect to that server under SSL. Those users will be prompted with an error message stating "Cannot connect to an expired server certificate."
Background
All VeriSign Server IDs are signed by a VeriSign CA root certificate ("root"). Roots are assigned finite validity periods to ensure the highest level of cryptographic protection, and hence, VeriSign must periodically create new roots.
These roots play a critical role in establishing Secure Sockets Layer (SSL) sessions. When a browser attempts to use SSL to connect to a server secured with a Server ID, the SSL protocol checks the browser's "root library" for the root that signed the specific Server ID. If the root is not present in the browser's root library, the SSL session can not be established.
As VeriSign creates new roots, it provides them to browser manufacturers for inclusion in the root libraries of their next browser versions. However, based upon the timing of VeriSign root creation relative to browser releases, different roots could be included in different browser versions. This can potentially create situations where an older browser may not have the latest VeriSign roots in its root library. If an older browser attempts to establish an SSL session with a Server ID that was signed by a root that isn't part of the browser's root library, the SSL session will fail.
Scenario
VeriSign previously signed Global Server IDs with a VeriSign Class 3 PCA Root that expires on 1/7/2004.
However, PKI standards are such that a CA can not sign a certificate that will expire after the CA itself expires. Hence, this VeriSign Class 3 PCA Root can not sign any certificates that would expire after 1/7/2004. Since VeriSign recently introduced the ability for Server IDs to be issued for 2-year periods, no 2-year Global Server IDs could be signed by the old root after 1/7/2002.
To alleviate this problem, VeriSign is now signing all Global Server IDs with a new VeriSign Class 3 PCA Root that expires in 2028. The new 2028 root is present in the latest browsers from Microsoft and Netscape, but is not present in IE 4.0.
Therefore, any organization with a newly issued Global Server ID can not enable customers using IE 4.0 to connect to that server under SSL. Those users will be prompted with an error message stating "Cannot connect to an expired server certificate."
Solution
Organizations hosting web sites with VeriSign Global Server IDs can resolve this problem with either of the following solutions:
1. Encourage all IE 4.0 visitors to upgrade to IE 5.0 or higher.
2. Direct IE 4.0 users to go to http://www.verisign.com/support/site/getCA.html to manually install the new VeriSign Class 3 PCA Root (expiring in 2028) into their browsers.