Slashdot Mirror
Verisign Certificate Expiration Causes Multiple Problems
We had to do a little sleuthing today. Many readers wrote in with problems that turned out to be related. A certificate which Verisign used for signing SSL certificates has expired. When applications which depend on that certificate try to make an SSL connection, they fail and try to access crl.verisign.com, the certificate revocation list server. This has effectively DOS'ed that site, and Verisign has now updated the DNS record for that address to include several non-routable addresses, reducing the load on their servers. Some applications affected include older Internet Explorer browsers, Java, and Norton Antivirus (which may manifest itself as Microsoft Word being very slow to start). Hope this helps a few people, and if you have other apps with problems, please post about them below.
(which may manifest itself as Microsoft Word being very slow to start)
But.. I thought this SSL certificate expired just today..
Trolling is a art,
In an effort to have us forget about SiteFinder, they're going for an even bigger fuck-up.
Nice try, guys... now turn the CRL server back on.
Well, it's good to know that not only crackers or script kiddies are good at taking down Verisign's services, that their own staff is good at it too.
Do not look into laser with remaining eye.
Heh.
The Army reading list
Self-signed certificates are fine for Joe-Hobby website, but when you're about to enter a credit card number online it's assuring to see that the SSL cert is signed by a real organization and not "l33t_d00d@hotmail.com"
Trolling is a art,
saying that your certificate is expired or not yet valid...except that it is...you need to go here.
and if you have other apps with problems, please post about them below.
I can't get the DOS version of Duke Nukem to run in Windows XP. Is this at all somehow related? Is there a fix??
On one of our customers' systems (IIS). Turns out they had already installed the new Verisign intermediate certificate but had not removed the old one. IIS happily used the old one...
Lesson: if the certificate expired yesterday, remove it from IIS and then reboot the thing.
Ceci n'est pas une signature
Unfortunately, unless you buy a cert from one of the officially blessed cert authorities, your users get this ugly-looking "security warning" popup from their browser. While this is fine for clued individuals, or internal sites and so on, things that are public-facing are more sensitive to that sort of thing.
It galls me every time I have to give someone on the officially "blessed CA" list money to do something I can do for myself in less time, but I don't know of an alternative that allows the public users of a secure website to not get alarming messages on their browser when they try to give us money.
unless your an average user who doesn't read certificates anyway, and will just click yes on pretty much everything
this sig is deprecated
In other news, Microsoft, Red Hat, Oracle, Sun, and Apple had to do a little coding today.
Rumors abound that Arnold Schwarzenegger had to do a little governing today, but these allegations remain unconfirmed at this time. More at eleven.
Obliteracy: Words with explosions
I find it particularly disturbing that their solution to too much traffic to their CRL server is to use non-routable addresses in DNS. As a result of this action, they have reduced the integrity of their certificates (yes, that means diluting TRUST, which is the foundation of PKI) by making the revocation lists unavailable. Without CRL checking, Verisign certificates have no inherit integrity advantage over self-signed certificates. This is what we pay for?
Non-authoritative answer:
Name: crl.verisign.net
Addresses: 10.0.0.1, 10.0.0.2, 10.0.0.3, 64.94.110.11
198.49.161.200, 198.49.161.205, 198.49.161.206
Aliases: crl.verisign.com
Go figure.
sPh
route the traffic to some "SiteFinder service"?
Error: Id10t detected
It is stupid for VeriSign not to have taken the steps necessary to keep their CRL available under these conditions seeing that they get paid a lot of money to do only 2 things:
1) Be trustworthy
2) Be competent
> ...when you're about to enter a credit card number
> online it's assuring to see that the SSL cert is
> signed by a real organization...
Unfortunately, we usually have to settle for Verisign instead.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
The most unfortunate thing about this. Is that with VeriSign especially, I find them to be one of the _most_ untrustworthy companies on the planet (How many times have they mis-issued certificates now? And lets not forget all the screwups related to their DNS scams). So the question is, who do you go to for certificates? Can't sign your own because users may feel you're insecure (justifiable or not) and can't trust certificates from the "official" CA's, because... well that's like trusting the goverment to make sure you get all your tax deductions whether you knew they were owed you or not ;)
I just really wish I could find an affordable CA that I felt was trustworthy enough themselves as to feel safe making my customers trust their certificates.
I received the following email yesterday: Oracle Corporation has been notified by Sun that the set of VeriSign Class 2 and Class 3 Certificates used in Oracle products will be expiring on January 7, 2004. Please review MetaLink Doc 260332.1: Expiration of VeriSign Class 2/Class 3 Certificates on Jan 7,2004 for detail information.
...if you have other apps with problems, please post about them below.
Well, now that you mention it, my mother hasn't been able to print for a week, my uncle's PC keeps running checkdisk on startup, and I'm having trouble compiling kernel 2.6.0.
Oh yeah, and Unreal 2k3 has crappy frame rates on the 'Antalus' level, but maybe thats just my old ti4200 card.
Um. I think that's it for now. So when are you going to help me with these?
I'd rather be a conservative nutjob than a liberal with no nuts and no job.
I would have to say more users click on "yes" for everything. I have to reinstall several family members computer because of spy/ad ware and a ton of other crap because the click yes to everything.
I didn't use the preview button, so get over it!!!!
Mike
Unless you have a P75, I don't see what you are talking about. MSWord has always started in less that 3 seconds on my system (PIII 700) and I can tell you that sometimes it is terribly bloated (My system, not Word).
Wait, did I just admit running Windows on slashdot? Bye bye Karma.
Write boring code, not shiny code!
I use Instant SSL cheap, good service and I haven't seen any compatibility issues.
Because of the crl problems, Explorer has been acting slowly doing some seemingly unrelated activities. Copying or right-clicking on folders often is followed by a several second hang. To workaround, deselect "Check for publisher's certificate revocation" under the Advanced setting for IE (even though it is not IE running, that's where the setting should be changed). After this, no more Explorer hangs. Hope this helps someone. If you know why Explorer is checking crls for anything when doing a copy operation on files, please post.
There's software out there so anyone can sign a certificate. Who needs the suits at Verisign?
Because a cert signed by you is useful for nothing more than "This conversation is encrypted, and I say I'm me." A cert signed by a Verisign translates to "This conversation is encrypted, and Verisign says I'm me."
What good is that? Well, not much among geeks, we don't trust Verisign further than we can throw them, but we're depending on them to keep this silly DNS thing going. However, web browsers are set with a default list of trusted "Certificate Authorites" who are allowed to sign certificates. Companies who are on those lists can sign a certificate that'll work without errors, anybody else's certificate will prompt a message indicating that the name's right, the time's valid, but the issuing authority isn't on the list of authorities you trust. (You can manually add a new authority if you want... but try convincing users to do that!)
The problem is, so many cheapskates have now signed their own certificate that the bogus authority error isn't stopping users since it's so common when nothing's really wrong. As a result, we're seeing a lot of look alike sites use SSL to get the padlock to come up, and users not being phased by the red-flag alerts that this doesn't seem to be the site they think it is.
It can be found here.
I think it beats another new "helpful" feature like "CRL Finder."
Uh, Thawte is owned by Verisign, smart guy...
But they are a lot cheaper for some reason... Go figure...
Unroutable addresses? Anyone on private corporate networks which are large enough to use 10.0.0.0/8, who are unfortunate enough to have been allocated the IP addresses 10.0.0.{1,2,3}, may be experiencing a little more network load than usual today as every machine in the place tries to query them.
GROGGS: alive and well and living in
Very nice of them to.. I don't know.. let someone know before today. We spent a ton of staff time this morning trying to figure out why we could connect to our servers but not the payment engines via ssl. 4 hours later we figured it out.
= fs alert%2F57436n dors/exp-gsid-s sl.html
Couple of nice links.
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc
http://www.verisign.com/support/ve
Just three more hours seapeople and you can finally take me away from this crappy God Damned planet full of hippies
What the hell does that mean, what does it do, and who do we sue[...]?
With that kind of reaction, I think you've more than proved you've got the mettle to be in management.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Or is it merely that some software automatically calls the mothership for new information on expiration, and the hostname of the mothership happens to start with "crl"?
(Antidisclaimer: I operate five private CAs and delude myself that I basically understand this stuff.)
"But all your emitter and collector are belong to me!"
- Not fuck up,
- Not fuck me over
But don't let it go to your head, l33t_d00d, that says more about them than you.the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
There is a file in the JDK called cacerts.
(find . -name cacerts is your friend), this contains the certificates Java uses when initiating ssl connections.
As of yesterday Sun was still shipping java with the expired 3a certificate.
The way to include the new 3a certificate is to use the keytool command.
The format is somthing like: keytool -v -keystore cacerts -import newcert.pem
The default password for java's cacerts file is "changeit"
VC
ps how many geek points do i get for fixing this last week?
Official GOD FAQ.
This vaguely reminds me of the fraudulent Verisign / Microsoft code-signing digital certificates that Verisign issued a few years back.
While not an identical problem, an essential element of why those certificates were potentially harmful was also because of a problem with the CRL checking. Verisign didn't support CRL distribution points in their certificates and you all remember the problems that ensued.
I found security researcher Gene Spafford's comments on the PKI / Verisign issue interesting, which were picked up in Bruce Schneier's Crypto-Gram. Schneier's comments on the incident as well as the Microsoft response are also worth reading.
It's unbelievable that Verisign which claims to be in the business of Internet security and SSL/TLS digital certificates - the dominant company with 95%+ market share - could let their Root Certificate Authority expire, then force its users to effectively patch their systems by importing the new certificate for the root CA after the fact. That's just bad engineering.
Yes, end-users need to take some responsibility for their systems, but PKI and related technologies are complex and not for novices. It's no better than the keep-your patches-updated-and-use-a-firewall comment that Bill Gates made a couple of months ago. That's a bandage, not a solution.
Self-certificates are worthless except when distributed through an existing secure channel. Without a proper certificate, all I know is I'm encrypting the session key with someone's public key, but I don't know whose it is. I might as well send the contents in the clear.
It is easier and less detectable to sniff a connection than it is to intercept and modify all data flowing over the connection. Thus a self signed cert is better than nothing, but it does indeed have obvious security failings.
I would love to see the Federal Trade Commission start granting digital certificates for little or no cost. Governments are already responsible for public security, and for granting identification documents such as social security cards and drivers' licenses, and for communications services such as running the postal service and opperating the Do Not Call Registry... why don't they do these things in the digital realm as well?
Mind you, I'm not calling for government regulation of the Internet... and certainly there is no way that government certificates should be in any way a requirement for opperating a secure website. There must still be commercial options available - and I'm sure they would become a lot more reasonably priced in the face of public competition. But if govenments are going to start taxing the Net (which they will), then certifying SSL certificates is the kind of service that they should be giving people in return.
SpyDock: Scientific Python in a Docker container
I have walked a user through performing the following procedure, and she has reported success with her two machines. She is running Windows 2000 Pro with Office 2000 and NAV 2003 (only 99% sure about the last one).
:P
- goto http://windowsupdate.microsoft.com/
- click Scan for Updates link (may be prompted to accept the ActiveX thing)
- Navigate to the page of non-critical updates (ironic, no?)
- Find the update named something like "Root Certificate Update" or "Root Certificate Authority" (can't remember which)
- Install it
- rejoice at the ability to use MS Word again
Keyboard not found.
Press F1 to continue.