I'm not sure what's more worrying, that CAs have continued to issue certificates for >398 days or that I'm not surprised that it's happened... 🤷♂️
Imagine buying a new certificate that looks like this!
NET::ERR_CERT_VALIDITY_TOO_LONG
NET::ERR_CERT_VALIDITY_TOO_LONG
Here's the certificate, they definitely missed the deadline:
Validity
Not Before: Sep 1 00:16:16 2020 GMT
Not After : Sep 1 00:16:16 2022 GMT
crt.sh/?id=3318010380
Validity
Not Before: Sep 1 00:16:16 2020 GMT
Not After : Sep 1 00:16:16 2022 GMT
crt.sh/?id=3318010380
It seems like there are 108 of them in total, so far, if my Censys query is correct. GoDaddy is winning(?) and it seems that there are 3 x EV and 2 x OV certificates in the mix. censys.io/certificates?q…
After a deep, technical analysis into the cause of the problem that resulted in 100+ certificates being issued in breach of the BRs, @GoDaddy provided an incident report:
"It was difficult to locate in the document where it stated that all effective dates are UTC time."
"It was difficult to locate in the document where it stated that all effective dates are UTC time."
What you have to realise is that this is a CA. An organisation that is entrusted with operating a critical component of the Web when it comes to security. Their incident report basically boils down to "uh yeah sorry we didn't really read the document properly" 🤷♂️
