Slashdot Log In
Verisign Certificate Expiration Causes Multiple Problems
Posted by
michael
on Thu Jan 08, 2004 03:46 PM
from the rot-at-the-root dept.
from the rot-at-the-root dept.
We had to do a little sleuthing today. Many readers wrote in with problems that turned out to be related. A certificate which Verisign used for signing SSL certificates has expired. When applications which depend on that certificate try to make an SSL connection, they fail and try to access crl.verisign.com, the certificate revocation list server. This has effectively DOS'ed that site, and Verisign has now updated the DNS record for that address to include several non-routable addresses, reducing the load on their servers. Some applications affected include older Internet Explorer browsers, Java, and Norton Antivirus (which may manifest itself as Microsoft Word being very slow to start). Hope this helps a few people, and if you have other apps with problems, please post about them below.
This discussion has been archived.
No new comments can be posted.
Verisign Certificate Expiration Causes Multiple Problems
|
Log In/Create an Account
| Top
| 360 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Now I'm confused. (Score:5, Funny)
(http://www.grub.net/blog/index.html | Last Journal: Wednesday June 27, @08:48AM)
(which may manifest itself as Microsoft Word being very slow to start)
But.. I thought this SSL certificate expired just today..
Not the first Verisign CRL certificate problem (Score:5, Interesting)
(http://geartest.com/ | Last Journal: Wednesday January 23 2002, @12:59AM)
This vaguely reminds me of the fraudulent Verisign / Microsoft code-signing digital certificates [pkiforum.com] that Verisign issued a few years back.
While not an identical problem, an essential element of why those certificates were potentially harmful was also because of a problem with the CRL checking. Verisign didn't support CRL distribution points [pkiforum.com] in their certificates and you all remember the problems that ensued.
I found security researcher Gene Spafford's comments on the PKI / Verisign [pkiforum.com] issue interesting, which were picked up in Bruce Schneier's Crypto-Gram [schneier.com]. Schneier's comments on the incident [schneier.com] as well as the Microsoft response [microsoft.com] are also worth reading.
It's unbelievable that Verisign which claims to be in the business of Internet security and SSL/TLS digital certificates - the dominant company with 95%+ market share - could let their Root Certificate Authority expire, then force its users to effectively patch their systems by importing the new certificate for the root CA after the fact. That's just bad engineering.
Yes, end-users need to take some responsibility for their systems, but PKI and related technologies are complex and not for novices. It's no better than the keep-your patches-updated-and-use-a-firewall comment that Bill Gates made [slashdot.org] a couple of months ago. That's a bandage, not a solution.
The reason is obvious (Score:5, Funny)
Nice try, guys... now turn the CRL server back on.
Re:Who needs them? (Score:5, Informative)
(http://www.grub.net/blog/index.html | Last Journal: Wednesday June 27, @08:48AM)
Self-signed certificates are fine for Joe-Hobby website, but when you're about to enter a credit card number online it's assuring to see that the SSL cert is signed by a real organization and not "l33t_d00d@hotmail.com"
Re:Who needs them? (Score:5, Insightful)
(http://slashdot.org/ | Last Journal: Saturday April 24 2004, @10:21PM)
Re:Who needs them? (Score:5, Insightful)
Re:Who needs them? (Score:5, Funny)
> online it's assuring to see that the SSL cert is
> signed by a real organization...
Unfortunately, we usually have to settle for Verisign instead.
Verisign isn't the only game in town (Score:5, Informative)
(http://feedharvest.com/)
Re:Verisign isn't the only game in town (Score:4, Insightful)
now is it just me or is that a funny statistic?
"...conducting sub $50 transactions (for sites conducting higher value transactions please see InstantSSL Pro or PremiumSSL certificate types)."
I really don't think I should disclose how big my transactions are to this company. It's really none of their business.
What if I'm selling bumper stickers for $5. and some users wants to buy all 12 of the kinds I have? Or is it only per item? If so. I could sell ICs for $1.75 each and just sell them in lots of 50,000 to OEMs.
Re:Verisign isn't the only game in town (Score:4, Informative)
(http://feedharvest.com/)
Nope, it's a funny number, but it seems to be some kind if industry norm [whichssl.com].
I really don't think I should disclose how big my transactions are to this company. It's really none of their business.
Actually you don't. What this does is provides a sort of insurance to the consumer. See here [instantssl.com].
It's just peace of mind for the consumer, that says that if I/you rip them off as an InstantSSL customer, InstantSSL will guarantee any fraudulant transaction up to the amount of your cert.
Re:Who needs them? (Score:5, Informative)
(http://womble.decadent.org.uk/)
Re:Who needs them? (Score:5, Insightful)
(http://www.productrecallwatch.com/ | Last Journal: Tuesday October 09, @10:26PM)
It galls me every time I have to give someone on the officially "blessed CA" list money to do something I can do for myself in less time, but I don't know of an alternative that allows the public users of a secure website to not get alarming messages on their browser when they try to give us money.
Re:Who needs them? (Score:5, Insightful)
I just really wish I could find an affordable CA that I felt was trustworthy enough themselves as to feel safe making my customers trust their certificates.
Re:Who needs them? (Score:5, Informative)
(http://www.llabmik.net/ | Last Journal: Monday March 21 2005, @04:31PM)
But they are a lot cheaper for some reason... Go figure...
Re:Who needs them? (Score:5, Informative)
Because a cert signed by you is useful for nothing more than "This conversation is encrypted, and I say I'm me." A cert signed by a Verisign translates to "This conversation is encrypted, and Verisign says I'm me."
What good is that? Well, not much among geeks, we don't trust Verisign further than we can throw them, but we're depending on them to keep this silly DNS thing going. However, web browsers are set with a default list of trusted "Certificate Authorites" who are allowed to sign certificates. Companies who are on those lists can sign a certificate that'll work without errors, anybody else's certificate will prompt a message indicating that the name's right, the time's valid, but the issuing authority isn't on the list of authorities you trust. (You can manually add a new authority if you want... but try convincing users to do that!)
The problem is, so many cheapskates have now signed their own certificate that the bogus authority error isn't stopping users since it's so common when nothing's really wrong. As a result, we're seeing a lot of look alike sites use SSL to get the padlock to come up, and users not being phased by the red-flag alerts that this doesn't seem to be the site they think it is.
Hmmmm... (Score:5, Funny)
A little testy... (Score:5, Funny)
(http://tomcopeland.blogs.com/)
Heh.
Re:A little testy... (Score:5, Funny)
(http://slashdot.org/)
Of course they neglected to include that the notice was on display on the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.'
What are you talking about? (Score:5, Funny)
(http://nerds.palmdrive.net/)
Wait, did I just admit running Windows on slashdot? Bye bye Karma.
If people are getting errors coming to your site.. (Score:5, Informative)
(http://nharmon.multics.org/)
Progress (Score:5, Funny)
(http://users.pandora.be/redx | Last Journal: Sunday March 19 2006, @01:26PM)
Duke Nukem (Score:5, Funny)
I can't get the DOS version of Duke Nukem to run in Windows XP. Is this at all somehow related? Is there a fix??
Fixed this today... (Score:5, Informative)
(Last Journal: Saturday May 01 2004, @04:37AM)
Lesson: if the certificate expired yesterday, remove it from IIS and then reboot the thing.
Re:Fixed this today... (Score:5, Funny)
(http://arstechnica.com/journals/linux.ars)
Lesson: if the certificate expired yesterday, remove IIS [apache.org] and then reboot the thing.
HTH. HAND.
Soko
Re:Fixed this today... (Score:5, Funny)
(http://www.t-swat.com/)
Lesson: If __________________, reboot the thing.
Heh. (Score:5, Funny)
(http://www.snowplow.org/tom/)
In other news, Microsoft, Red Hat, Oracle, Sun, and Apple had to do a little coding today.
Rumors abound that Arnold Schwarzenegger had to do a little governing today, but these allegations remain unconfirmed at this time. More at eleven.
null routing Certificate Revocation List Server. (Score:5, Insightful)
(http://www.deadly.org/)
Non-authoritative answer:
Name: crl.verisign.net
Addresses: 10.0.0.1, 10.0.0.2, 10.0.0.3, 64.94.110.11
198.49.161.200, 198.49.161.205, 198.49.161.206
Aliases: crl.verisign.com
Re:null routing Certificate Revocation List Server (Score:4, Funny)
(http://www.feelourpain.com/)
I think it beats another new "helpful" feature like "CRL Finder."
Windows Explorer (Score:5, Informative)
Unroutable, schmunroutable (Score:5, Interesting)
(http://marnanel.org/ | Last Journal: Thursday January 18 2007, @03:21PM)
Fee was too high (Score:5, Funny)
sPh
You mean they didn't... (Score:3, Funny)
VeriSign is lame (Score:5, Insightful)
1) Be trustworthy
2) Be competent
Also problems with Oracle (Score:3, Informative)
(http://www.menwithrecords.com/)
I can't find ANY info on Oracle's website about this, though. The memo was sent to Oracle Premium Support customers but I don't know if the info has been generally distributed.
Woops!
Oracle notified me of this yesterday... (Score:3, Informative)
problems (Score:5, Funny)
(http://www.rushlimbaugh.com/home/parody.guest.html)
Well, now that you mention it, my mother hasn't been able to print for a week, my uncle's PC keeps running checkdisk on startup, and I'm having trouble compiling kernel 2.6.0.
Oh yeah, and Unreal 2k3 has crappy frame rates on the 'Antalus' level, but maybe thats just my old ti4200 card.
Um. I think that's it for now. So when are you going to help me with these?
Workaround to Explorer problems (Score:5, Informative)
Re:Workaround to Explorer problems (Score:5, Informative)
So, to clarify, when you try to do a file operation, like copy, Norton intercepts the operation so it can check the file for a virus, then gets itself held up while waiting for IE to tell it if the signature is valid so it can check for that virus. End result is that Explorer never gets an answer from Norton and the operation hangs. Ditto for Word and other applications Norton watches closely.
I too had this same problem on one of two Dell laptops. One used the default McAfee ScanShield that came with it, the other had been reloaded with Norton Anti-Virus. That machine had all sorts of crazy errors, such as Word hanging during opening, hanging when you right-clicked a file, hanging when you tried copying files.
The system also had ooodles of pending updates from Microsoft that had been downloaded but not installed. I'm willing to bet one of them was a root server update or similar. Of course, the problem could be on Norton's end, meaning they need to update the security cert on their server? I'm not sure exactly how it works.
- JoeShmoe
.
Its happening on most servers. (Score:5, Informative)
(http://gringots.net/)
Couple of nice links.
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc
http://www.verisign.com/support/ve
Why should expired cert => CRL traffic spike?? (Score:4, Interesting)
Or is it merely that some software automatically calls the mothership for new information on expiration, and the hostname of the mothership happens to start with "crl"?
(Antidisclaimer: I operate five private CAs and delude myself that I basically understand this stuff.)
Warning: broken apps you might not think about (Score:5, Insightful)
(Last Journal: Sunday May 20 2007, @11:56AM)
CA certs in Java (Score:4, Informative)
(http://eve-links.com/)
(find . -name cacerts is your friend), this contains the certificates Java uses when initiating ssl connections.
As of yesterday Sun was still shipping java with the expired 3a certificate.
The way to include the new 3a certificate is to use the keytool command.
The format is somthing like: keytool -v -keystore cacerts -import newcert.pem
The default password for java's cacerts file is "changeit"
VC
ps how many geek points do i get for fixing this last week?
There are alternatives to Verisign... (Score:3, Informative)
beTRUSTed [betrusted.com], which recently purchased [baltimore.com] Baltimore's CyberTrust and OmniRoot businesses. I used Baltimore's certs all the time to avoid VeriSign.
Digital Signature Trust [digsigtrust.com], a subsidiary of Identrus [identrus.com]. I've used their TrustID certs to avoid giving money to VeriSign as well.
Both of the above certificate authorities have their roots in the most current IE and Netscape/Mozilla browsers. Digital Signature Trust does a lot of stuff with banks (being owned by Identrus, which was created by a bunch of banks).
My company was affected... (Score:3, Informative)
The fix was as follows: Open Internet Options, click Advanced tab. Under Security turn off both Check for Server Certificate Revocation and Check for Publisher Certificate Revocation. I think this fix should work for other apps that are affected by the same problem...Thought I'd pass it along.
On a side note, it's pretty scary that this has happened to begin with. What I had to go though was pretty minor since the problem was on one machine, but what about an entire enterprise with an app installed on 1000's of computers that were broken because of this? Because of all this ridiculous "signed app" nonsense, not only are you down, but through proxy Microsoft made you dependant on one of the biggest bastardized companies I know...Verisign. Don't expect this problem to fix itself in a timely manner.
If this is a sign of things to come, Palladium will bring Hell on earth.
Explorer, IE, Excel, Word, IIS - XP, 2K (Score:3, Funny)
(Last Journal: Monday November 08 2004, @01:16AM)
Wouldn't have been so bad if it was just my company, but folks from other companies, friends of friends, political buddies of friends of friends...
see also Windows Update (Score:4, Interesting)
(http://127.0.0.1/~luser/ | Last Journal: Sunday October 28 2001, @02:05PM)
- goto http://windowsupdate.microsoft.com/ [microsoft.com]
- click Scan for Updates link (may be prompted to accept the ActiveX thing)
- Navigate to the page of non-critical updates (ironic, no?)
- Find the update named something like "Root Certificate Update" or "Root Certificate Authority" (can't remember which)
- Install it
- rejoice at the ability to use MS Word again
Re:Uhm... (Score:4, Funny)
With that kind of reaction, I think you've more than proved you've got the mettle to be in management.