Federal HTTPS domains that'll expire soon because of US government shutdown

https://techcrunch.com/2019/01/17/federal-https-domains-expire-government-shutdown/

by jmsflknr • 8 years ago

240 190 8 years ago

tomohawk3• 8 years ago

Automated renewal with letsencrypt is a thing. Blaming this on the shutdown rather than on not taking appropriate care to do this more robustly? Meh.

jlarocco• 8 years ago

Techcrunch doesn't load for me after I started blocking cookies, but is it about the renewal or paying for it?

Automation doesn't matter if the spending isn't approved.

umanwizard2• 8 years ago

The article sort of implies both.

because so many federal workers have been sent home on unpaid leave — or worse, working without pay but trying to fill in for most of their furloughed department — expired certificates aren’t getting renewed. Renewing certificates doesn’t take much time or effort — sometimes just a click of a mouse. But some do cost money, and during a government shutdown there isn’t any.

My personal guess is that the author of the article doesn't know which it is.

smsm423• 8 years ago

I am usually all for privatization but having .gov CA and issuing new certs without any spending sounds like something that would be a sensible idea even for the most hardcore libertarian. I don't see why government must buy certificates in retail instead of just having its own authority (which it has anyway in .gov domain btw).

pavlov2• 8 years ago

The employees tasked with clicking the "Renew Certificate" button every X months probably have no idea how they'd go about that.

As a contracting project, I imagine it would be pretty expensive to upgrade every single website of the US federal government to use Let's Encrypt. How many different operating systems and web server setups there must be?

tomohawk3• 8 years ago

My point is that said employees / contractors should have a better plan than having to be there at a certain time to push a button. That's planning for failure.

What if the contract has a problem? It happens. What if the approving official is out sick for a month? It happens.

Not knowing how to set these things up? I don't really think that's an excuse. This should be addressed in the requirements.

beat3• 8 years ago

Done fed-wide, it would make more sense to set up the federal government as a top-level certificate authority, and build a LetsEncryptAlike that does the same thing.

merlincorey• 8 years ago

Automated renewal with letsencrypt is a thing.

The article mentions it is a thing in the following cases:

"""Any website that’s hosted on cloud.gov, search.gov or federalist.18f.gov won’t go down as they rely on Let’s Encrypt certificates that automatically renew every three months."""

jonas21• 8 years ago

Not using Let's Encrypt automated renewal isn't necessarily due to a lack of care.

Some of the sites listed use EV certificates, which aren't supported by Let's Encrypt.

And using Let's Encrypt for automated renewal comes with risks of its own. Note, for example, that very few of the "major sponsors" listed on the Let's Encrypt website use Let's Encrypt for their own sites.

jteppinette2• 8 years ago

What risks? Major sponsors not using Let’s Encrypt is most likely due to marketing departments using third party software running the company site. I don’t know why, but marketing usually doesn’t want engineering anywhere near their public sites...

craftyguy3• 8 years ago

In addition, even if they had set up Let's Encrypt auto-renewal, they may have had to shut down the system running it before they left. Leaving a system up that you won't be around to patch/maintain is almost always worse than shutting it down until you get back.

setum• 8 years ago

But some do cost money, and during a government shutdown there isn’t any.

CydeWeys2• 8 years ago

Automated renewal only works so long as your servers doing said renewal continue working. This is by no means guaranteed.

How long do you think the average company's IT infrastructure would continue working if all employees instantly dropped dead? With no one to respond to any issues that crop up, and nothing that isn't 100% automated happening at all?

jammygit• 8 years ago

I was wondering something for a project I'm considering. If I build a web app for somebody and move on, am I even doing them a favour unless I maintain it for years too?

Not experienced enough to have an answer

egwor• 8 years ago

Most of the stuff that I wrote in my last job was designed to keep going whatever. I didn't want to be disturbed with issues and as a tiny team we automated and fixed everything that was likely to cause us issues. I left >6mo go and it is still running without issues now. If a box dies it flips to another box on another data centre etc.

belorn4• 8 years ago

I have been using lets encrypt now for about a year for about a hundred domains, and I never had to do a manual renewal.

The biggest benefit of lets encrypt for companies is not the price. Having someone responsible for renewal, getting the bills through the billing system and approved, getting it installed. All those steps involve employees that could be spending their time on something more important. If any part of the chain fail there will also be a massive fallout which can be very costly. Automated renewal changes all this to a initial cost during construction of the service, usually during the per-production phase.

My concern would not be about the automated renewal if all employees instantly dropped dead. Sooner or later a service will hang, some resources exhausted, and things stop to work.

rhizome3• 8 years ago

How long do you think the average company's IT infrastructure would continue working if all employees instantly dropped dead?

Infra that I've built? Years. If that makes me above-average, I hope it's only barely.

Karunamon3• 8 years ago

Wee bit misleading - this is about cert expiration, not domain expiration.

jessriedel• 8 years ago

Not just misleading, literally wrong based on the plain meaning of the words.

jamieweb2• 8 years ago

I bet that domain names will be expiring too... of course the .gov domains should be fine as it's a restricted TLD, but many government organisations have other non-.gov domains too.

aboutruby• 8 years ago

isitdoneyet.gov Really?

givehimagun• 8 years ago

Looks like its a food safety website from the USDA recommending cooking temperatures. Is It Done Yet makes sense.

rhacker• 8 years ago

Well, except that it doesn't make sense for them to actually have a domain for it. The domain does a 301 directly to a page within the usda.gov site. The domain itself doesn't even come up on a search for isitdoneyet, instead just the forwarded page does. So no, while the content is useful, having a separate domain and SSL certificate, really isn't useful.

larkeith• 8 years ago

I noticed that one too - it actually redirects to a USDA page with information on what temperature foods are safely cooked at.

shanecleveland• 8 years ago

My shutdown-proof version: http://donetemperature.com

smsm423• 8 years ago

I pretty much expected to find there the site about whether government shutdown is finished or not :)

rebuilder• 8 years ago

I'm not seeing a lot of sites that actually handle private data for the majority of users.

woofcat• 8 years ago

Is techcrunch.com now for people who are hard of sight? That's a massive font.

maccio92• 8 years ago

well most technies in silicon valley are painfully short-sighted

nimbius2• 8 years ago

Disclosure: im a full-time diesel engine mechanic.

my shop was due for a round of vessel inspections for our waste and fresh oil holding tanks last friday, but, no EPA. Without these inspections we can not technically order new oil or have oil recycled, because the EPA signoff is required as part of cradle-to-grave handling of hazmat substances.

so how do we get around it? we now have half our back parking lot filled with 55 gallon drums of waste byproduct from engine work, which can be shipped without an EPA cert to recyclers. This is also outright illegal if it gets big enough, but we've been declaring it as required by the EPA. since we cant schedule a formal review of that either, we confirm the storage with their hotline for doing so, and since thats not staffed and the voicemail box is full, I have been mailing Kodak pictures and printed descriptions of the storage.

our full-site inspection is due feb 2nd...without it, the federal government (if it were running) would cite us for a flagrant violation and shut us down. The guy who does that inspection called us and confirmed hes quitting to work for...of all places...the company that recycles our oil.

el_benhameen• 8 years ago

Every time I read one of your comments I think “is that the same diesel guy?”, and so it is. You always have some of the most interesting things to say here.

veb• 8 years ago

He has a tag 'diesel mechanic' on Momento: https://chrome.google.com/webstore/detail/momento-for-hacker... - it's actually pretty handy! :)

dagoat• 8 years ago

Just to clarify, are you saying you're able to recycle your oil without inspection and also wont't have to undergo a full site inspection (if the gov remains shutdown)?

nimbius2• 8 years ago

sealed vessels under a certain capacity can be recycled normally by most companies. we dont often do it because its cumbersome, and larger holding tanks are safer than random barrels that get forgotten and dont have leak alarms or overflow alarms. large tanks require certification, samples, and periodic checks to make sure we arent secretly filling them full of nacho cheese or something and not waste oil.

that having been said, we will still require an EPA site inspection, and im pretty sure when that happens theyll be rather accommodating to any lapses in certification. Id dread having to check that voicemail box though.

odorousrex• 8 years ago

our full-site inspection is due feb 2nd...without it, the federal government (if it were running) would cite us for a flagrant violation and shut us down. The guy who does that inspection called us and confirmed hes quitting to work for...of all places...the company that recycles our oil.

What will you do when this date comes around?

I'm going to assume you just can't shut down and lose business? Do you just keep at it and take the hit in fines/whatnot when the govt. reopens?

To think similar things are happening at mechanic shops all over the country... it's a bit horrifying honestly. Diesel is nasty stuff.

ageitgey• 8 years ago

There's lots of weird legal impacts of the shutdown. Some are big issues, like your situation with hazardous materials and trying to comply with the law. Others are tiny things that impact everyday people in weird ways.

My particular issue is that I'm trying to arrange to transport my dog across country lines on an airplane. But the county I'm flying to requires my vet to complete a vaccination certificate which then has to be stamped by the USDA APHIS office (normally no big deal). But of course this is currently impossible because USDA APHIS is shut down and doesn't even answer their phones. It's not clear if any alternate path exists to get around this.

Kalium4• 8 years ago

Oh! I have a relevant and potentially helpful life experience.

Twice in my life I have needed to get a cat from Point A in central time to Point B somewhere in California. Handling all the vaccinations and associated paperwork was (in one case) annoying or (in the other) the person who actually owned the cat not remotely organized enough to have records.

It turns out some domestic airlines will permit you to fly with a pet on-board in a soft-side case under the seat where one might normally put a bag. This may or may not work for you, depending on how patient and large your dog is and how big your budget is.

netsharc2• 8 years ago

Couldn't you ask the country representative? A more expensive way night be to get a stamp from the destination country authorities that confirms your dog has all the relevant vaccines (is the stamping doable via post?)

elliekelly• 8 years ago

If you can demonstrate that you’ve substantively complied with the regulations to the best of your ability given the circumstances (and it sounds like you can) I would imagine most regulators and/or administrative judges have better things to do than try to ding you for this.

Quick edit: Might want to make sure you’ve got something between the storage containers and the ground though so there won’t be any leeching into the soil.

Source: I’m a regulatory compliance attorney. Mostly investment management but I moonlight as a legal journalist covering EPA enforcement cases.

reaperducer2• 8 years ago

I would imagine most regulators and/or administrative judges have better things to do than try to ding you for this.

In my experience running businesses in several states, regulators are surprisingly helpful. They don't want to punish you unless you're being a deliberate jerk. They want to help you learn to comply with the law first. They'll only go for the throat if you tell them to pound sand.

jcoby• 8 years ago

Interesting. I make a part that a large diesel manufacturer uses on fixed and marine diesels to clean the crankcase air and meet EPA regs. I noticed a big uptick in purchasing right around the shutdown and then it fell off a cliff. I chalked it up to holidays but now I wonder if everyone is deferring maintenance since they can't do anything with the waste.

slg5• 8 years ago

The guy who does that inspection called us and confirmed hes quitting to work for...of all places...the company that recycles our oil.

This type of thing is one part of the story that not enough people are focusing on regarding the shutdown. How many people are going to come back to these jobs once the shutdown inevitably does end? Odds are these "nonessential" government departments will be crippled for years by the loss of both experience and manpower.

bargl• 8 years ago

This.

I have been on the non-essential side, so I know some people who are moving on. It's all anecdotal, but I'd be curious to see what the cost of this shutdown is going to be.

wwweston3• 8 years ago

One of the things that needs to be understood is that this is intentional.

The Grover Norquist "drown it in a bathtub" contingent of the Republican party is large, influential, and for them, this is not at all unfortunate collateral damage in pursuit of The Wall or something. The crippling of public institutions (if not outright dissolution) is part and parcel with the ideology.

And that's even if you don't believe that the executive branch may have been compromised by a foreign power interested in weakening and destabilizing the United States.

lamarpye2• 8 years ago

I would guess close to all of them. A large percentage of people that work for the Federal Government really don't add much value and not employable outside of that setting.

Of course, I could be wrong, but I am willing to bet on it, if anyone is interested.

towndrunk• 8 years ago

Off topic: I would like to chat about the diesel mechanic business. Any way to contact you?

listenallyall• 8 years ago

I would be interested in hearing your (and owner, coworkers, etc) honest opinion of the EPA regs prior to this shutdown. My understanding (and I very well could be wrong) is that many of the EPA's rules are overly burdensome, expensive, and unnecessary while there are other areas that go without oversight that could use it.

Certainly it is frustrating to be blocked from conducting business because you are unable to follow the regulations. But if the regulations are misguided to begin with, perhaps there is some merit in exposing that life and business can continue with reduced bureaucracy.

femto1133• 8 years ago

I really wish browsers would deemphasize certificate expiry as a problem (say to just an ! on the lock icon)--it is literally meaningless from a cryptographic security perspective. I also think it is misleading users about the usefulness of certificates, since neither browsers nor certificate vendors track or report things that do meaningfully impact security, e.g. if the company that originally bought the certificate was sold to EvilCorp or the server has been compromised by hackers.

kakarot• 8 years ago

it is literally meaningless from a cryptographic security perspective.

Care to elaborate?

jaytaylor2• 8 years ago

They're probably trying to say the connection will still be securely encrypted, albeit without the guarantee that communication is between you and the party / identity you expect on the other end (possible MITM attack scenario).

femto1133• 8 years ago

A certificate is essentially a cryptographic key that one entity (the "issuer") asserts was issued to some other entity (the "subject"). Whether that assertion is true now, was true a day ago, or was never true does not affect the strength or usefulness of that key for cryptography. Other attributes of the key, like its bit length, do matter, but when it was issued and when it "expires" absolutely do not.

I find this misleading because the implied value of the certificate to the end user, that "you can be sure you are talking to the entity you think you are talking to and nobody else", is not really what the issuer is promising. They're just saying something like "we verified the company that bought this really is named XYZ". They are NOT saying that "the entity that operates the server you're communicating with is under the control of XYZ corp". It's entirely possible for a certificate to be sold to XYZ corp, which emails the certificate to a IT consultant, which FTPs it to a Word Press hosting company that deploys it to a server run by a cohosting company where it's used to market services that are fulfilled by independent contractors. The issuer doesn't touch on anything beyond the first step in that chain but the browser's freaking out and going full red screen the second the certificate "expires" might make you think that it does.

michaelt• 8 years ago

Certificate expiry is intended to address things like:

* If at some point in the certificate's life it was leaked, but you didn't notice and so didn't get it revoked.

* If there are old certs kicking around and you're not sure of the details. e.g. previous owners of the domain, previous sysadmin who was careless with their recordkeeping, and suchlike.

* If a certificate has been revoked, but CRL distribution isn't as good as we'd like so people don't know about it.

* If certificate issuance rules have updated/tightened, e.g. SHA1 Deprecation.

* Limits the ability of CAs to back-date certificates to get around rule tightening (which they shouldn't be doing anyway, of course, but might hope to do undetected)

All of these are slow-moving security issues, so you're no more at risk the day after the cert expires than you were the day before. And hopefully not many sysadmins have problems like lost certificates, which makes the protection cert expiry offers seem redundant.

jamieweb2• 8 years ago

Expired certificates are not checked for revocation, so it could have been compromised and revoked, but your browser wouldn't block the connection.

Unfortunately in reality very few organisations actually revoke certificates. Revocation doesn't really work anyway (except for EV certs), but even if it did, most organisations still probably wouldn't do it.

DKnoll• 8 years ago

It does affect trust to some extent. For example I could have had control over a domain a decade ago, got a trusted cert, then let the domain lapse and MITM it later after it was acquired by somebody else with my still valid cert (if they never expire). Regular validation to ensure the cert owner still has control of the domain is important.

That said, I agree that the way browsers handle SSL can mislead users about their privacy and security on the Internet.

jcranmer• 8 years ago

When the notAfter date rolls around, the CA is no longer obligated to include the certificate in CRLs (or OCSP responses). Effectively, when a certificate is expired, it is no longer possible to detect whether or not it was revoked.

Expired certificates must therefore be treated with at least the same alarm as revoked certificates, which is the most severe status condition you can return (as it could mean "we believe someone else to have access to the private key").

stordoff2• 8 years ago

I can see the argument, but completely ignoring the date means that you only have to control the domain _once_ to have a certificate forever. A grace period of a few days might more sense, but completely ignoring the date seems risky.

belorn4• 8 years ago

I would be much more interested in domain names that will expire. If funding is stopped one would guess that domain registrars might start allowing some names to expire, which then anyone can try to catch.

jacoblsievers• 8 years ago

I doubt that "anyone" can grab a .gov address.

belorn4• 8 years ago

I was more considering all the multitude of other domain names. Just like companies, government agencies and departments tend to have a lot of domains spread out on multiple registrars, tld's, and for many different reasons. It can be to cover misspellings, one-time projects, awareness campaign, and so on.

empath75• 8 years ago

You can’t register .gov domains that way.

daebersold• 8 years ago

Nevermind it would have taken 2 seconds to setup a cron job to autorenew their SSLs. Typical government.

Karunamon3• 8 years ago

Assuming they were using best practices and something like LetsEncrypt (unlikely) or even a larger outfit that implements ACME (do those even exist yet?).

No, more likely, there's a sysadmin somewhere that's furloughed, has the reminders in his inbox, and has to kick off an arduous procurement process involving three layers of bureaucratic horseshit involving five signoffs each, and at least a 60 day window before Verisign nee Symantec gets paid an exhorbitant amount of money and issues the all important bit of code.

No doubt this is exaggerated, but I firmly believe that government/large enterprise procurement is one of the levels of hell. Take something that should be a simple, five minute process and stack layers upon layers of nonsense on top.

flukus• 8 years ago

Maybe designing things to break periodically without intervention wasn't such a good idea.

fareesh4• 8 years ago

The US government shutdowns of the past have seemed like political posturing over budgets, but this time the situation seems genuinely important - I have read so much about the gangs and violence and trafficking that is taking place in the border region. It's surprising that your politicians are able to take a genuine issue like this and turn it into a political one. It's also surprising that common people want the border to be unprotected. What sense does it make?

asdff5• 8 years ago

What you've been reading has been a gross mischaracterization on the issues. Less than one half of one percent of border patrol agents surveyed by the Senate Homeland Security committee want a wall (1), and that's because a wall won't change the situation. It is well known that the overwhelming majority of illegal immigrants arrived by legal means through a port of entry and overstayed their visa. It is also well known that immigrant populations in the united states commit less crime per capita than native born populations. The whole idea of the wall has been around since Mexico declared independence from Spain, and has long been rooted in racism and fear, not fact or data (2)

1. https://www.nytimes.com/2019/01/05/us/politics/donald-trump-...

2. https://www.sandiegouniontribune.com/news/nation-world/ct-me...

lamarpye2• 8 years ago

I want a wall because I think the reducing the supply of unskilled labor will tend to raised wages for unskilled workers in the United States.

senderista2• 8 years ago

I'm sure this is all true, but I'm also sure that the population of visa overstayers and the population of illegal border-crossers have vastly different characteristics, including crime rate. This seems like an essential distinction for this discussion since only the latter is relevant to border security, yet I have not seen anyone make it (nor do I know if the relevant data exists).

tropo• 8 years ago

That's a conflict of interest if there ever were one. If you are paid to catch violators, you want more violators.

Also, you're conflating "illegal immigrants" with "immigrant populations". When mentioning crime, you suddenly switch to discussing a group of people who have patiently followed the immigration law and paid all the fees.

jquery3• 8 years ago

It's funny, people against the wall keep bringing up the cost/effectiveness of the wall, as if Democrats would support the wall if it was only more fiscally responsible or effective, meanwhile people who support the wall would probably be willing to spend 5-10x the estimated cost, they'd be willing to spend $50-100B if that's what it took.

So, if walls don't work, isn't that an even better argument for Democrats to just give Trump his wall money? After all, it won't have any substantial effect on Americans, but this shutdown sure will if it keeps going. Or are Democrats more concerned about being the party of anti-Trump than being the adults in the room? After all, every right-thinking person knows Trump is the child throwing a tantrum in this shutdown. So wouldn't we be better served by Democrats taking care of Americans by ending the shutdown than teaching Trump a lesson in the minutiae of wall effectiveness per dollar spent?

fareesh4• 8 years ago

What does that have to do with what I said though? Illegal immigration is a separate issue from what I understand. This is about dealing with the humanitarian crisis associated with a porous border.

Regardless how what percentage of people come via visa overstay or not, and regardless of what officials say when asked about solving an illegal immigration issue, the bottom line is that the area is so incredibly dangerous because gangs and criminals prey on anyone who attempts the trip and has the misfortune of encountering them. Over the years, it's quite likely that thousands, perhaps hundreds of thousands of victims of violence have been created purely because they make this dangerous trip. Why not put an end to this violence once and for all? They would not make this trip anymore if there was no simple way to cross the border.

rexpop2• 8 years ago

What have you read? Have you read "No Wall They Can Build?"

https://crimethinc.com/books/no-wall-they-can-build

stordoff2• 8 years ago

It's also surprising that common people want the border to be unprotected.

Most places don't have a wall[1]. Characterising the lack of a wall as the border being unprotected seems unfair.

[1] https://en.wikipedia.org/wiki/Border_barrier#List_of_current...

fareesh4• 8 years ago

I believe the proposal is to have a wall wherever it makes sense and to have other measures where they make more sense.

smaslennikov• 8 years ago

My favourite part is that some of these sites are effectively blocked by chrome due to HSTS (e.g. manufacturing.gov), which renders them unusable for most.

smsm423• 8 years ago

manufacturing.gov has 1-year cert ending on Jan 14. Why didn't they create a new one in November 2018? It's not like Jan 14 coming is any kind of surprise. I can understand where snowfall takes a city by surprise - after all, it's hard to predict when exactly the snow would fall. But it's kinda easy to predict when January 14th would happen. Why didn't they prepare?

I'm not even saying why they don't have .gov CA with auto-renewal infrastructure - that'd be too much to ask. But at least some foresight?

Symbiote• 8 years ago

Minor inconveniences like this should reduce support for the government shutdown.

Also, isn't this the longest ever?

NicoJuicy3• 8 years ago

I know that political subject are not wanted.

But I have never seen the return between the wall, Trump and his real estate mentioned.

Is it plausibel that he wants a shutdown, so he can earn more money by building a wall?

peterwwillis• 8 years ago

Taking this opportunity to again expound about how not all websites need HTTPS:

First, most of these are basically info portals. Nobody is trying to steal or corrupt the data points for the fiscal budget expenditures this year, or the report on residential heating in remote arctic villages. In addition, none of the data is secret or private. So the data doesn't need to be protected.

The other reason people say everything needs HTTPS is not data security, but attacks on the client. If you use HTTP, someone can subvert the packets to inject malware into your client, etc. But this would be impossible if the browsers had methods to cryptographically verify the data's integrity without needing to keep it private. In other words a checksum, possibly even out-of-bound. This can be done securely and without the need to constantly expire and re-issue a certificate, and it also enables several useful technologies which require inspection and passing of data content in different scenarios.

Finally, the increased dependence on encryption for all communication makes our communication more fragile, and this is a great example. In the future, if everything uses https, and certs expire, either most of the content of the web will expire, or if we allow clients and tools to not verify certificates, we undermine the purpose of the certificates to begin with. Let's Encrypt cron jobs will not work forever (if you don't upgrade, eventually the crypto you were using for your cert will become obsolete), network operations can be attacked to prevent re-signing, not every domain has a server that runs cron jobs, there's no guarantee Let's Encrypt will be around forever, and it may not work in non-US countries.

Unrelated, but I also think expiring certificates can be worked around. They force you to expire and re-sign them because they could get cracked or (less likely) the private key could leak. But certificates can also be revoked at any time. As far as I can tell, it's not possible to tell if a certificate has been revoked if an attacker doesn't want you to be able to tell, since PKI has to work offline. So you could be getting pwned all the way up to the cert expiring. Instead, we could simply expire certificates when we want to rotate them, rather than letting them auto-die and catch unaware admins with their pants around their ankles.

Some people say we need to get rid of PKI, but I don't think that's a good idea. Rather than throw the baby out with the bath water, let's improve the baby. That goes for the registrars, CAs and DNS, too. (The way cert signing happens today is, I think, a bit of a joke, and registrars need to play a more key role)

choward• 8 years ago

Misleading title. I thought the domains were expiring and was wondering what that had to do with HTTPS. Their SSL certificates are expiring, not the domains.

Federal HTTPS domains that'll expire soon because of US government shutdown

Related Stories