Subject: [Tools-discuss] Some instances of tools have an expired certificate

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 29 Apr 2014 14:58:44 +0200

Some have a correct certificate
<https://gist.github.com/bortzmeyer/11399235> and some do not, the
cert is expired
<https://twitter.com/flogisoft/status/461126638739009536/photo/1>

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 29 Apr 2014 08:02:09 -0700

> <https://twitter.com/flogisoft/status/461126638739009536/photo/1>

To clarify, it seems like Stephane is saying some of the boxes have up-to-date certs, but one or more does not.

--Paul Hoffman

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 29 Apr 2014 18:47:48 +0200

Hi Stephane,

> <https://twitter.com/flogisoft/status/461126638739009536/photo/1>

I cannot reproduce this.  If you are able to reproduce it, could
you go to https://tools.ietf.org/server and let me know how it
identifies itself?  (THere are multiple servers with A and AAAA
DNS entries, so having the server name and/or IP address helps a lot).

Best regards,

	Henrik

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 29 Apr 2014 10:06:04 -0700

On Apr 29, 2014, at 9:47 AM, Henrik Levkowetz <[email-masked]> wrote:

> I cannot reproduce this.  

But I can.

> If you are able to reproduce it, could

Server name:	cabernet
Server address:	192.36.165.30
Client address:	142.254.17.198
Local time:	Tue Apr 29 19:03:59 2014

The expired cert is below. In specific:
        Validity
            Not Before: Oct  8 19:13:50 2011 GMT
            Not After : Nov 30 23:34:19 2012 GMT

--Paul Hoffman

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 29 Apr 2014 19:15:44 +0200

Hi Paul,

This is weird.  Both by inspection of what's in the file system,
and by explicitly going to https://cabernet.tools.ietf.org/, I
get a good certificate (expires 2014-12-01).  Did you grab the
cert below at the same time as you grabbed the data at
https://tools.ietf.org/server, or earlier?

	Henrik

On 2014-04-29 19:06 Paul Hoffman said the following:
> MIIFkDCCBHigAwIBAgIHBAQI2QDvsTANBgkqhkiG9w0BAQUFADCB3DELMAkGA1UE
> BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAj
> BgNVBAoTHFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xOTA3BgNVBAsTMGh0
> dHA6Ly9jZXJ0aWZpY2F0ZXMuc3RhcmZpZWxkdGVjaC5jb20vcmVwb3NpdG9yeTEx
> MC8GA1UEAxMoU3RhcmZpZWxkIFNlY3VyZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
> eTERMA8GA1UEBRMIMTA2ODg0MzUwHhcNMTExMDA4MTkxMzUwWhcNMTIxMTMwMjMz
> NDE5WjBZMRkwFwYDVQQKFBAqLnRvb2xzLmlldGYub3JnMSEwHwYDVQQLExhEb21h
> aW4gQ29udHJvbCBWYWxpZGF0ZWQxGTAXBgNVBAMUECoudG9vbHMuaWV0Zi5vcmcw
> ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCx4Tfo64LWifrb9cJLd/As
> St5ybj4TYNGoZh7ErT0yYOXwmbX0enpIVSHuDjkS+c4NyvVpYccE7W4PHTseUIh5
> Og4xQRbxsQJkaKXN9UoKypmWNQjDfidd0KnP8+corzfYtnvd836ubpd/98ppTszQ
> Bt9dJ5s7Eufm/ghrUnuCEXxys0brweh4uA/L4eu9BkRY3INQsqBiW9yBuDbjnnx5
> sqlTiuALyUoqEzkxE70sz6hwz4yNPQGjiK4SADYdHiQr3XnYUwEm7ShPyYaUg07I
> 4RQuhbOv1G7daUavQSUOeq2L8pLKedl7Mk/3d+j5tE8jXNRcA67YqzrKE19dXV2h
> AgMBAAGjggHXMIIB0zAPBgNVHRMBAf8EBTADAQEAMB0GA1UdJQQWMBQGCCsGAQUF
> BwMBBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCBaAwOQYDVR0fBDIwMDAuoCygKoYo
> aHR0cDovL2NybC5zdGFyZmllbGR0ZWNoLmNvbS9zZnMxLTIwLmNybDBZBgNVHSAE
> UjBQME4GC2CGSAGG/W4BBxcBMD8wPQYIKwYBBQUHAgEWMWh0dHA6Ly9jZXJ0aWZp
> Y2F0ZXMuc3RhcmZpZWxkdGVjaC5jb20vcmVwb3NpdG9yeS8wgY0GCCsGAQUFBwEB
> BIGAMH4wKgYIKwYBBQUHMAGGHmh0dHA6Ly9vY3NwLnN0YXJmaWVsZHRlY2guY29t
> LzBQBggrBgEFBQcwAoZEaHR0cDovL2NlcnRpZmljYXRlcy5zdGFyZmllbGR0ZWNo
> LmNvbS9yZXBvc2l0b3J5L3NmX2ludGVybWVkaWF0ZS5jcnQwHwYDVR0jBBgwFoAU
> SUtSJ9EbvPKhIWpie1FCeorX1VYwKwYDVR0RBCQwIoIQKi50b29scy5pZXRmLm9y
> Z4IOdG9vbHMuaWV0Zi5vcmcwHQYDVR0OBBYEFK2KtBwHUdeSiQewt4RiLzZVel9N
> MA0GCSqGSIb3DQEBBQUAA4IBAQDEt/M8IMm9MYpMoNMThJ9TjUkOtVI/Igx24gZS
> ghsgIx2x2F37wkirbZejwpPSfj2CdRC6bhMurr8a2IhIduMHHzlr9Y7tq3Bt/JK2
> 3f8FMz6xC2YEoTo1LuYs04wMX0QrsHyXy4oOZl2fZZ4VsKrctDfwB9f2SnXFXc1w
> Kli8V7Cljo4K7uB5mc2fBx2NBx0PvY4rZFEAxlJhTqeZ60t7S+iuRVFk8DiGrzCJ
> 5PAhthRVbPABgAaVf2dIes6ukNTJ8QPoPBtkH35ih35s+HuOVX8miisw0n8Gb5KS
> 5NaIZzKkeWk1AqsY4EhlaF7WM4D8OqYKfhFJHVt41lHlswlc

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 29 Apr 2014 10:20:22 -0700

> https://tools.ietf.org/server, or earlier?

Earlier, inherently. That is, I resolved the URL in a browser; it complained about the cert. I captured the cert from the complaint window and said to temporarily trust it, and then got to the screen with the data.

Why don't you just go to the file system of each of the n servers and look at the cert directly? It's clearly coming from somewhere. The fact that you can't find it easily indicates a deeper problem with the synchronization.

--Paul Hoffman

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 29 Apr 2014 20:01:48 +0200

On 2014-04-29 19:20 Paul Hoffman said the following:
>> and by explicitly going to https://cabernet.tools.ietf.org/, I get
>> a good certificate (expires 2014-12-01).  Did you grab the cert
>> below at the same time as you grabbed the data at 
> Earlier, inherently. That is, I resolved the URL in a browser; it
> complained about the cert. I captured the cert from the complaint
> window and said to temporarily trust it, and then got to the screen
> with the data.
> 
> Why don't you just go to the file system of each of the n servers and
> look at the cert directly? It's clearly coming from somewhere. The
> fact that you can't find it easily indicates a deeper problem with
> the synchronization.

In the first line of my message above, I said '...by inspection of what's in
the file system ...'.  That translates to "I went to the file system of each
of the n servers and looked at the cert directly".

	Henrik

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 29 Apr 2014 11:24:57 -0700

> of the n servers and looked at the cert directly".

I'm not sure what to say, then. I clearly didn't make up the cert that I sent, and I got it using the exact steps I told you.

--Paul Hoffman

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 29 Apr 2014 20:52:56 +0200

Hi Paul,

> I'm not sure what to say, then. I clearly didn't make up the cert that I sent, and I got it using the exact steps I told you.

Oh, I believe you, and I have a tentative theory (below); my latest point
was that it's not helpful to suggest someone does something he's already
indicated he did.

If my theory is right, you got the cert from a box which should *not*
have been in the DNS round-robin, but was for a little while.  It's an old
box which isn't used for anything any more, and certainly isn't part of
the tools servers, but it snuck into the zone file for tools by a
cut-and-paste error.

A suspicion of something like that was the reason I asked if the cert was
captured before you captured the screen data.  If that was the case, there
could have been a change in what tools.ietf.org resolved to in between the
two.  Especially since between the time I asked the question, and the time
you responded, I'd checked the zone file and pushed out a new version ,:-)

	Henrik

---

From: Chris Morrow <[email-masked]>
Date: Tue, 29 Apr 2014 15:10:10 -0400

On 04/29/2014 02:24 PM, Paul Hoffman wrote:
>> In the first line of my message above, I said '...by inspection of
>> what's in the file system ...'.  That translates to "I went to the
>> file system of each of the n servers and looked at the cert
>> directly".
> 
> I'm not sure what to say, then. I clearly didn't make up the cert
> that I sent, and I got it using the exact steps I told you.

it might be worth looking at ssllabs.com's output for tools.ietf.org...

which shows 'inconsistent configuration' for the 3 servers.

www.ssllabs.com/ssltest/analyze.html?d=tools.ietf.org

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 29 Apr 2014 22:05:13 +0200

> www.ssllabs.com/ssltest/analyze.html?d=tools.ietf.org

Good point.  Updating the 192.36.165.30 configuration to match the
others.

Best regards,

	Henrik