Microsoft forgot to renew the certificate for its Windows Insider subdomain
- Reference: 1654889477
- News link: https://www.theregister.co.uk/2022/06/10/microsoft_insider_certificate/
- Source link:
Attempting to visit the Windows Insider portal was returning the familiar "Your connection is not private" warning – as if webpages larded with scripts and trackers can truly be called "private." The problem has now been fixed, and someone's no doubt getting an earful.
Browsers like Chrome, Firefox, and Safari will attempt to deter visitors from accessing the webpage, but will provide a link for those who ignore the warnings and persist on clicking through to advanced options.
[1]
We did so and lived to tell about it.
[2]
[3]
The Insider web page certificate expired on Thursday, June 9, 2022 at 4:59:59 PM Pacific Daylight Time.
[4]
Click to enlarge
Microsoft did not immediately respond to a request for comment. But clicking through the warnings on Firefox initially took this reporter to Microsoft's main Windows page with 302 and 307 redirect responses – Microsoft is redirecting requests to its expired page and so is aware of the issue.
[5]Email domain for NPM lib with 6m downloads a week grabbed by expert to make a point
[6]Expired cert breaks Windows 11 snipping tool, emoji panel, S Mode features, other stuff
[7]Xero, Slack suffer outages just as Let's Encrypt root cert expiry downs other websites, services
[8]Happy New Year: Jan 1, 2021 security cert expiration causes havoc for some Check Point VPN users
This sort of snafu happens occasionally. In November, 2021, an expired cert affected Windows 11 version 21H2 – it prevented Windows users from opening certain apps [9]like the snipping tool .
And in 2020, an expired authentication certificate [10]prevented customers from accessing Microsoft Teams.
Cert expirations tend to be worse when they affect root certificates and bork services for multiple vendors and customers. The [11]expiration of Sectigo's AddTrust legacy root certificate two years ago affected thousands of customers.
[12]
They're also rather disruptive when they occur at telecom companies, the [13]2018 Ericsson cert expiration that hindered communications among tens of millions of UK customers.
Maybe Window's scheduling systems aren't all they are cracked up to be. ®
Get our [14]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/channel&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YqO-AoNPCtajCK1W0ZN3bwAAAJU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/channel&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YqO-AoNPCtajCK1W0ZN3bwAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/channel&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YqO-AoNPCtajCK1W0ZN3bwAAAJU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://regmedia.co.uk/2022/06/10/windows_screenshot.jpg
[5] https://www.theregister.com/2022/05/10/security_npm_email/
[6] https://www.theregister.com/2021/11/04/expired_certificate_windows11/
[7] https://www.theregister.com/2021/09/30/lets_encrypt_xero_slack_outages/
[8] https://www.theregister.com/2021/01/05/certificate_check_point/
[9] https://www.theregister.com/2021/11/04/expired_certificate_windows11/
[10] https://www.theregister.com/2020/02/03/teams_down/
[11] https://www.theregister.com/2020/06/02/sectigo_root_cert_expires/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/channel&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YqO-AoNPCtajCK1W0ZN3bwAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2018/12/06/ericsson_o2_telefonica_uk_outage/
[14] https://whitepapers.theregister.com/
Should have just set up a cron job. Much more reliable.
Utterly unprofessional
Didn't they let the main domain registration expire once and somebody renewed it for them?
That would have been fun, and then a redirect to linux.org or apple.com, or an FBI seizure style webpage with "This domain has been confiscated for your safety and privacy".
:)
Too big to fail?
It seems more like a case of too big to keep everything straight.
It reminds me of my Outlook account which would periodically flag Microsoft emails as junk.
Then again, maybe it was just being honest.
20 seconds of thought ...
Whenever your in house systems CA issues a cert, an API call is made to the monitoring system that adds that cert to a list to monitor.
Oh silly me, devops don't do monitoring - not cool enough 8)
Expired certificates are so yesterday.