$ openssl s_client -connect objects.githubusercontent.com:443
CONNECTED(00000005)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io
verify error:num=10:certificate has expired
notAfter=Mar 21 23:59:59 2023 GMT
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io
notAfter=Mar 21 23:59:59 2023 GMT
verify return:1
---
Certificate chain
0 s:C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io
i:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
1 s:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
$ curl -i -L https://github.com/kyleconroy/sqlc/releases/download/v1.17.0/sqlc_1.17.0_linux_amd64.tar.gz
HTTP/2 302
server: GitHub.com
date: Fri, 24 Mar 2023 20:51:56 GMT
content-type: text/html; charset=utf-8
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/193160679/09048595-c7f4-45b5-858a-7f55baa2fd7d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230324%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230324T205156Z&X-Amz-Expires=300&X-Amz-Signature=772d0aa8c5c19b0a5ef84d718d2faf0d81f24b224a4ef634d2410787e8f50bad&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=193160679&response-content-disposition=attachment%3B%20filename%3Dsqlc_1.17.0_linux_amd64.tar.gz&response-content-type=application%2Foctet-stream
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Definitely a bad for them. When it rains, it pours.
"Windows Azure Service Disruption from Expired Certificate" (2013) - https://azure.microsoft.com/en-us/blog/windows-azure-service...
Not After Tue, 21 Mar 2023 23:59:59 GMT
3-day certs.
That’s because they already resolved the issue → https://www.githubstatus.com/incidents/x7njwb481j9b
This is what I saw an hour ago:
$ echo | openssl s_client -connect avatars.githubusercontent.com:443
CONNECTED(00000005)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io
>>> verify error:num=10:certificate has expired
notAfter=Mar 21 23:59:59 2023 GMT
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = *.github.io
notAfter=Mar 21 23:59:59 2023 GMT
verify return:1If you do that on Feb 29th of a leap year, it'll throw an exception because the next year doesn't have a Feb 29th! Oops.
They "fixed" it and promptly had another related outage the very next day.
» TIMEZONE=UTC date; openssl s_client -connect support.github.com:443 2>&1 | grep 'cert.*has.*ex'
Fri Mar 24 17:40:28 EDT 2023
verify error:num=10:certificate has expired
Verify return code: 10 (certificate has expired)
curl https://www.githubstatus.com/ -vvvv -I
\* Trying 52.215.192.131:443...
\* Connected to www.githubstatus.com (52.215.192.131) port 443 (#0)
\* ALPN: offers h2
\* ALPN: offers http/1.1
...
\* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384
\* ALPN: server accepted h2
\* Server certificate:
\* subject: CN=apistatus.chorus.co.nz
\* start date: Mar 6 23:10:30 2023 GMT
\* expire date: Jun 4 23:10:29 2023 GMT
\* subjectAltName: host "www.githubstatus.com" matched cert's "www.githubstatus.com"
\* issuer: C=US; O=Let's Encrypt; CN=R3
\* SSL certificate verify ok.
\* Using HTTP2, server supports multiplexingFailing for us in GitHub Actions
For SEO purposes:
npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID
npm ERR! errno ERR_TLS_CERT_ALTNAME_INVALID
npm ERR! request to https://pkg-
npm.githubusercontent.com/npmregistryv2prod/blobs/\*\* failed, reason:
Hostname/IP does not match certificate's altnames: Host: pkg-npm.githubusercontent.com. is not in the cert's altnames: DNS:\*.githubassets.com, DNS:githubassets.comhttps://twitter.com/viibeeng/status/1639374358287118336
(*yeah we can all make mistakes, but it's 2023, if you've not build controls into your workflows by now you don't deserve to be a Senior anything)
https://ismycertexpired.com/check?domain=objects.githubuserc...