From: Dave Taht <dave.taht@gmail.com>
To: "cerowrt-devel@lists.bufferbloat.net"
<cerowrt-devel@lists.bufferbloat.net>
Subject: [Cerowrt-devel] expiring certs kill juniper routers
Date: Thu, 27 Mar 2014 13:04:22 -0700 [thread overview]
Message-ID: <CAA93jw4hjiUjB1760i3HcMOwELb5xV1uzPMdFwTceNr8riL-Aw@mail.gmail.com> (raw)
A whole bunch of juniper routers just went down due to an expired certificate:
http://www.gossamer-threads.com/lists/nsp/juniper/50450
We set the cerowrt https certificates to expire in 2072. I plan on being
safely dead by then... but...
I worried that I might actually get uploaded instead... and still be around...
so there's a cron job to create new ones every year.
1 3 2 1 * /etc/make-webcerts.sh # regen the web certs every year feb 1 at 3am
It bugs me that the openssl syntax for generating certs is so arcane,
and it bothers me
more that there are people making bad certs out there for mission
critical equipment.
"We're sorry, your vw bug can't start due to an expired certificate...
we're sorry,
your nuclear reactor's coolant interfaces can't start due to an
expired certificate."
It kind of dwarfs the Y2038 problem in that it can happen anywhere, anytime.
--
Dave Täht
next reply other threads:[~2014-03-27 20:04 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-27 20:04 Dave Taht [this message]
2014-04-01 15:42 ` Maciej Soltysiak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.bufferbloat.net/postorius/lists/cerowrt-devel.lists.bufferbloat.net/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAA93jw4hjiUjB1760i3HcMOwELb5xV1uzPMdFwTceNr8riL-Aw@mail.gmail.com \
--to=dave.taht@gmail.com \
--cc=cerowrt-devel@lists.bufferbloat.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox