Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.
But let me guess… something TLS cert or PHP-related? 😆😭
Hell of a week to be off sick.
What are You Working on Wednesday
Submitted 12 hours ago by shellsharks@infosec.pub to cybersecurity@infosec.pub
JRaccoon@discuss.tchncs.de 10 hours ago
It was a bit of a day at work, I must say.
It started well, we were only minimally affected by the PHP apocalypse. Only two services to update, neither of them mission critical AND even better, both were already on fairly recent patches, so updating them was pretty much a five-minute job once the patch was released.
Then we had a bit of a TLS issue, not related to eMudhra tho. Our public TLS certificates auto-renewed yesterday, routine stuff. But today two different clients complained that their browsers were giving them SSL errors. After a bit of back and forth, it turned out that our cert provider had switched to a new CA, and the IT departments at those two clients had, for some reason, pinned our domain to a specific CA and that had now to be updated. I can fully understand this kind of setup for internal CAs and such, but our service is on the public internet and uses a well-known SSL provider. This is the first time we’ve encountered something like this. I’m wondering whether it’s common for IT departments to do this. If so, why? Anyway, one customer had no problem with this, but the other tried to blame the “downtime” on us. Apparently, they expect us to warn them at least two weeks before rotating TLS certs. Trying to explain how ACME works didn’t help.
Final headache of the day, one of our developers forwarded me an email they’d received from Atlassian. At first, it looked like a scam attempt (it started with something like “You need to make changes immediately!”), but it turned out to be real. Apparently, Bitbucket is changing their SSH endpoint. While that doesn’t seem like a too big deal, their messaging about it is just absolutely horrible. The deadline is in less than a month(!), but almost all their documentation still refers to the old endpoint. Even
https://bitbucket.org/site/sshstill only returns the old hostname! I was really confused where to find the new host keys, but apparently they’ve decided to use the same host keys for the new hostname. That seems a bit odd to me, but it’s whatever… Then as a final F from Atlassian, when I tested connecting to the new hostname, the whole of Bitbucket went down. You can’t make this stuff up! Okay, I don’t think my connection attempt was what actually crashed it, but still, I wouldn’t be too surprised even if it was.