Slashdot Mirror
Google Let Root Certificate For Gmail Expire
Gr8Apes writes: The certificate for Google's intermediate certificate authority expired Saturday. The certificate was used to issue Gmail's certificate for SMTP, and the expiration at 11:55am EDT caused many e-mail clients to stop receiving Gmail messages. While the problem affected most Gmail users using PC and mobile mail clients, Web access to Gmail was unaffected. I guess Google Calendar failed to notify someone.
Yeah I only use Tinder for all my communication.
This seems so prophetic now:
Obligatory XKCD Link
How come Slashdot never gets Slashdotted?
Lol, I write my patches 160 characters at a time, now to figure out why nothing has been merged...
because you should never sign a cert that has an expiration date later that that of the signing cert !
I always find it amazing that these huge companies with enormous public domains don't have a person who's job description includes managing all of their certs and making sure they don't expire. You could even assign the job to two people just to make sure one of them doesn't get sick or something and miss one.
I read the internet for the articles.
I am GRoot.
Lost at C:>. Found at C.
I usually figure out that a cert has expired when something breaks. For example, I like to use free certs from StartSSL on Exchange Servers. When they expire, people get warnings when accessing OWA, or smartphones stop connecting.
If it happens to be on an SBS Server it can really be a pain, however, since it will stop working as a Terminal Services Gateway, making it difficult to log back on and replace the cert.
Whever I was in charge, I always saw that there where three people responsible. Because we are in Europe, we would have people having holidays between 20 to 40 days a year, so 1 would be the backup of the first and the second one would be backup for when the second one would be sick when the first one was on a holiday.
Obviously only group email adresses should be used to contact with external partners, so a followup would be possible.
People have called me stoopid for doing it that way, but it has saved the company more than once.
Don't fight for your country, if your country does not fight for you.
The internet has become one giant Rube Goldberg machine. Way too many parts and dependencies.
No, I don't have an alternative, but that's not a requirement to point out that the web seems pretty fragile.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
I just don't see Google slipping up by "forgetting" (how can you excuse that in this day and age?)
I think something else happened.
"If any question why we died, Tell them because our fathers lied."
The alert was probably sent to a GMail account.
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
As much as I like to take issue when a summary truly is unenlightening and makes unreasonable expectations of readers, I don't think this is such a case. Slashdot isn't a general news site, and does have a specific target readership, the vast majority of which are going to know what a certificate is and what SMTP is.
And anyway, whose mother? Some mothers would need the meaning of "ISP" spelled out for them over several sentences. Some mothers don't have even a vague grasp of what the internet is. Where do you draw the line?
At least it wouldn't be over the head of this mom.
* How does this [-] a normal user?
* What can they [-] or not do now?
* What do they have [-] watch out for?
Blimey, if you want to talk about clarity...
systemd is Roko's Basilisk.
The certificate was used to issue Gmail's certificate for SMTP, and the expiration at 11:55am EDT caused many e-mail clients to stop receiving Gmail messages
If the certificate was "for SMTP", the problem would have affected not just end users, but also peers, i.e. other e-mail providers who wanted to deliver mail to @gmail.com addresses. Or at least they may have automatically fallen back to unencrypted SMTP delivery (which was pretty much the default before Snowden, but anyway).
As it seems even tech giant google gets it wrong with its own certs. Lets hope that Let's Encrypt will make these problems of yesterday one day.
Well, the web mailer wasn't affected because the site uses different certificates, and neither were Google's other gmail clients, e.g. the Gmail app on Android, because those all use the Gmail API (again, with different certificates) rather than SMTP. So if you're paranoid enough, you may suspect malice rather than sloppiness. :-P
"Google Internet Authority G2" is NOT a root certificate (subject != issuer).
Some mothers also could run circles around you talking about the internet...
WARNING! This girl exceeds the MAXIMUM SAFE standards established by the FDA for BRATTINESS
wonkey_monkey, I'm guessing you are actually wonkey_human.
Yes, I think I have an explanation. Google has been degrading rapidly. More and more Google is out of control. To me, that is very sad. For years, Google was an amazingly excellent company.
The Google traffic map near Portland, Oregon shows traffic accidents in Seattle, 3 hours away. The design of the text in the upper left corner of Google maps is very poor.
There are many other issues of that nature.
From IBM:
Question
FAQ: Why do certificates have an expiration date? (SCI97674)
Answer
Digital certificates are breakable and are only considered to be secure for a limited period of time.? As of 2006, a? certificate based on? the standard? 1024 bit encryption string is only considered to be secure for 1-2 years and so certificates should expire and be replaced after no more than 2 years. Note