71 votes

Tilde is kill?

Posted by hungariantoast
Tags: certification, security

SEC_ERROR_EXPIRED_CERTIFICATE

@Deimos did you forget that Let's Encrypt stopped emailing expiration reminders?

49 comments

  1. [14]
    Deimos
    Link
    I didn't forget, but I did manage to set my own reminder for the wrong date.

    I didn't forget, but I did manage to set my own reminder for the wrong date.

    122 votes
    1. [10]
      teaearlgraycold
      Link Parent
      Why no certbot cronjob?

      Why no certbot cronjob?

      14 votes
      1. [9]
        Deimos
        Link Parent
        Is there a way to do that without needing to store DNS credentials on the server? I'm probably being overly paranoid, but doing that worries me and I'd really prefer to keep them separated.

        Is there a way to do that without needing to store DNS credentials on the server? I'm probably being overly paranoid, but doing that worries me and I'd really prefer to keep them separated.

        20 votes
        1. [6]
          teaearlgraycold
          Link Parent
          You don't need DNS credentials on the server. I'm guessing you're used to the DNS-01 challenge type. There are other challenge types available. Using HTTP-01 should work well for you. You can...

          You don't need DNS credentials on the server. I'm guessing you're used to the DNS-01 challenge type. There are other challenge types available. Using HTTP-01 should work well for you. You can write a shell script with certbot's --manual flag to put the challenge token somewhere for your Python server to read. Or you could give certbot a web root and configure nginx to route there for the specific magic path.

          20 votes
          1. [5]
            davek804
            Link Parent
            Http challenge does the job just fine. Can be a little annoying if you want a wildcard.

            Http challenge does the job just fine. Can be a little annoying if you want a wildcard.

            6 votes
            1. [4]
              bme
              Link Parent
              Yes! Assuming the gitlab code is up to date it would be easy enough to stick certbot with http-01 behind the nginx instance and run on a timer. I'd be happy to take this on if it was wanted.

              Yes! Assuming the gitlab code is up to date it would be easy enough to stick certbot with http-01 behind the nginx instance and run on a timer. I'd be happy to take this on if it was wanted.

              5 votes
              1. [3]
                teaearlgraycold
                Link Parent
                You’ll need to change the requested domains. Currently tildes’ certificate has a couple of wildcard domains. You’ll want to figure out the full list of subdomains we use and list them in the...

                You’ll need to change the requested domains. Currently tildes’ certificate has a couple of wildcard domains. You’ll want to figure out the full list of subdomains we use and list them in the request to LE.

                6 votes
                1. [2]
                  bme
                  (edited )
                  Link Parent
                  Thanks for the hint. I had a 30 second glance at the ansible playbooks before bed. I'll have a real look on the weekend. EDIT: https://gitlab.com/tildes/tildes/-/issues/833

                  Thanks for the hint. I had a 30 second glance at the ansible playbooks before bed. I'll have a real look on the weekend.

                  EDIT: https://gitlab.com/tildes/tildes/-/issues/833

                  4 votes
                  1. teaearlgraycold
                    Link Parent
                    Don’t forget tild.es and its subdomains

                    Don’t forget tild.es and its subdomains

                    2 votes
        2. whs
          (edited )
          Link Parent
          AWS Route53 allows for IAM policy that matches the name the user is allowed to write using conditional policy. I set it to _acme-challenge.* + type TXT Policy document { "Version": "2012-10-17",...

          AWS Route53 allows for IAM policy that matches the name the user is allowed to write using conditional policy. I set it to _acme-challenge.* + type TXT

          Policy document 
          {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": [
        "arn:aws:route53:::hostedzone/*",
        "arn:aws:route53:::change/*"
      ],
      "Action": [
        "route53:ListResourceRecordSets",
        "route53:GetChange"
      ]
    },
    {
      "Effect": "Allow",
      "Resource": [
        "arn:aws:route53:::hostedzone/*"
      ],
      "Action": [
        "route53:ChangeResourceRecordSets"
      ],
      "Condition": {
        "ForAllValues:StringLike": {
          "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
            "_acme-challenge.*"
          ]
        },
        "ForAllValues:StringEquals": {
          "route53:ChangeResourceRecordSetsRecordTypes": [
            "TXT"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Resource": "*",
      "Action": [
        "route53:ListHostedZonesByName",
        "route53:ListHostedZones"
      ]
    }
  ]
}
          5 votes
        3. pumpkin-eater
          Link Parent
          What I do with DNS challenge is run cert renewal scripts via cron on a different machine, and then rsync the certs over to the webservers

          What I do with DNS challenge is run cert renewal scripts via cron on a different machine, and then rsync the certs over to the webservers

          3 votes
    2. [3]
      BeanBurrito
      Link Parent
      Which date?

      Which date?

      4 votes
      1. [2]
        Deimos
        Link Parent
        Accidentally set it in September instead of August.

        Accidentally set it in September instead of August.

        11 votes
        1. Diff
          Link Parent
          When I was a lad, I used to give the wrong date for my own August birthday all the time. August was meant to be the 9th month of the year. Did make it difficult to recover my Nickelodeon account...

          When I was a lad, I used to give the wrong date for my own August birthday all the time. August was meant to be the 9th month of the year. Did make it difficult to recover my Nickelodeon account one time though.

          8 votes
  2. [2]
    gpl
    Link
    where were you when tilde dies “tilde is kill” “no”

    where were you when tilde dies

    “tilde is kill”

    “no”

    35 votes
    1. TaylorSwiftsPickles
      Link Parent
      i was at house sleeping with blåhaj when phone ring

      i was at house sleeping with blåhaj when phone ring

      15 votes
  3. [9]
    cloud_loud
    Link
    That explains why I had to press proceed anyway

    That explains why I had to press proceed anyway

    9 votes
    1. [5]
      BeanBurrito
      Link Parent
      Librewolf nor Chromium would let me do that.

      Librewolf nor Chromium would let me do that.

      8 votes
      1. 0x29A
        Link Parent
        Yeah, Firefox would not let me proceed either (no exception option and no "continue"), specifically due to HSTS, I believe, the spec of which I think directly specifies not allowing to get around...

        Yeah, Firefox would not let me proceed either (no exception option and no "continue"), specifically due to HSTS, I believe, the spec of which I think directly specifies not allowing to get around it (from what I've read). Of course that only goes as far as browser vendors' choices to implement it

        Which, in reality, is a good thing, because connecting to the site in the expired state could represent a security situation more dangerous than the mundane "expired cert" so it was protecting me.

        I could have ultimately found a way around if it felt absolutely necessary, but figured it was just worth waiting.

        12 votes
      2. [3]
        teaearlgraycold
        Link Parent
        You may be able to get a “Accept the risk and continue” button to appear by blindly typing “thisisunsafe” into the page.

        You may be able to get a “Accept the risk and continue” button to appear by blindly typing “thisisunsafe” into the page.

        11 votes
        2. BeanBurrito
          Link Parent
          Usually I do, but this time two different browsers did not offer that.

          Usually I do, but this time two different browsers did not offer that.

          3 votes
    2. [2]
      Minori
      Link Parent
      What browser let you proceed anyway?

      What browser let you proceed anyway?

      5 votes
      1. JXM
        Link Parent
        Most will. It’s just intentionally hard to do, since 99% of the time, it’s a good idea initially to proceed. So most people won’t even realize they can continue. I know Safari makes you click on a...

        Most will. It’s just intentionally hard to do, since 99% of the time, it’s a good idea initially to proceed. So most people won’t even realize they can continue. I know Safari makes you click on a harder to see text link instead of a button.

        8 votes
    3. TaylorSwiftsPickles
      (edited )
      Link Parent
      For anyone who did manage to somehow connect to tildes during the time the certificate was expired (even though HSTS was enabled and the secure option is set to true in the cookie) while logged...

      For anyone who did manage to somehow connect to tildes during the time the certificate was expired (even though HSTS was enabled and the secure option is set to true in the cookie) while logged in, consider logging out and back in order to reset your authentication cookie.

      3 votes
  4. donn
    Link
    Yeah, cert's expired

    Yeah, cert's expired

    Validity:
    Not after: Thu, 07 Aug 2025 20:45:41 GMT

    8 votes
  5. [2]
    JCPhoenix
    Link
    Oh god it's back. Phew. Yeah my browsers weren't letting me bypass the security notice. And I didn't feel like going deep into browser settings to allow me to do so.

    Oh god it's back. Phew. Yeah my browsers weren't letting me bypass the security notice. And I didn't feel like going deep into browser settings to allow me to do so.

    7 votes
    1. Notcoffeetable
      Link Parent
      Oddly I had the option on iOS Safari, but clicking the "proceed anyway" didn't do anything.

      Oddly I had the option on iOS Safari, but clicking the "proceed anyway" didn't do anything.

      5 votes
  6. [19]
    trim
    Link
    Oddly I get a domain parking page if I try and visit from my UK ISP. If I fire up the vpn, I can access normally. Strange.

    Oddly I get a domain parking page if I try and visit from my UK ISP.

    If I fire up the vpn, I can access normally. Strange.

    6 votes
    1. [18]
      cfabbro
      (edited )
      Link Parent
      Would you mind sharing a screenshot of the parking page, and maybe the Page Source of it too? I'm genuinely curious to see it, and figure out why that's happening... because it shouldn't be. You...

      Would you mind sharing a screenshot of the parking page, and maybe the Page Source of it too? I'm genuinely curious to see it, and figure out why that's happening... because it shouldn't be. You also might not be the only person experiencing that either, since someone commented on /r/tildes last night about encountering the same problem ~6 hours after the cert was updated.

      2 votes
      1. skybrian
        Link Parent
        I also saw some kind of domain parking page for a while yesterday.

        I also saw some kind of domain parking page for a while yesterday.

        5 votes
      2. [10]
        Notcoffeetable
        Link Parent
        I was getting the namecheap parking page for a bit last night (~6:30pm MT). I hadn't thought to check my phone's VPN, but I think I was on a US node. The whois record was showing expired and...

        I was getting the namecheap parking page for a bit last night (~6:30pm MT). I hadn't thought to check my phone's VPN, but I think I was on a US node. The whois record was showing expired and renewed, I assumed it was a gap propagation.

        4 votes
        1. [9]
          cfabbro
          Link Parent
          Yeah, that's what I assume too... but the comment from last night was 6 hours after the cert was updated so there should have been more than enough time for it to fully propagate, and trim's...

          Yeah, that's what I assume too... but the comment from last night was 6 hours after the cert was updated so there should have been more than enough time for it to fully propagate, and trim's comment above is a full day later. So I'm just a bit worried that something else might be causing the issue.

          1 vote
          1. [8]
            macleod
            Link Parent
            Had the same issue just a moment ago, parking page. Invalidated the cache, still had it, eventually navigated to docs.tildes.net and that seemed to allow me to access the rest of the site.

            Had the same issue just a moment ago, parking page. Invalidated the cache, still had it, eventually navigated to docs.tildes.net and that seemed to allow me to access the rest of the site.

            3 votes
            1. [2]
              TaylorSwiftsPickles
              Link Parent
              At least we know it's not that the UK government wants to force Deimos to verify UK users' ID cards before they create or continue using their account... yet.

              At least we know it's not that the UK government wants to force Deimos to verify UK users' ID cards before they create or continue using their account... yet.

              1 vote
              1. trim
                Link Parent
                That's honestly what went through my mind, that I'd just been geoblocked. Wouldn't surprise me if that happened. It is surely a risk to be allowing UK serfs access to this site, with it's person...

                That's honestly what went through my mind, that I'd just been geoblocked. Wouldn't surprise me if that happened. It is surely a risk to be allowing UK serfs access to this site, with it's person to person interactions and the UK's deliberately vague wishy-washy open to interpretation definition of "harms", without robust and meaningful personal information theft. Er. Validation.

                1 vote
            2. [5]
              cfabbro
              (edited )
              Link Parent
              Hmmm... weird. I wonder what would cause that to fix the issue for you. Maybe your ISP's DNS record for the docs.tildes.net subdomain got updated before the primary tildes.net domain record? :/ In...

              Hmmm... weird. I wonder what would cause that to fix the issue for you. Maybe your ISP's DNS record for the docs.tildes.net subdomain got updated before the primary tildes.net domain record? :/ In any case, if anyone else messages me still having the issue connecting to tildes, I will also suggest they try going to docs.tildes to solve it too. Thanks.

              cc: @Deimos, just so you're aware that there are potentially still some people having issues accessing Tildes after the cert renewal.

              1 vote
              1. [4]
                trim
                Link Parent
                I am still somewhat perplexed why a certificate expiry would cause domain parking. Did the domain also expire at the same time?

                I am still somewhat perplexed why a certificate expiry would cause domain parking. Did the domain also expire at the same time?

                2 votes
                1. [3]
                  cfabbro
                  Link Parent
                  I'm not entirely sure either, TBH, but I don't think it was the expiry itself that did it. When it was simply expired, people should have just gotten an expired cert warning in their browser like...

                  I'm not entirely sure either, TBH, but I don't think it was the expiry itself that did it. When it was simply expired, people should have just gotten an expired cert warning in their browser like a bunch of other users in this topic reported encountering. However, namecheap may temporarily default to their parking page when a DNS record has been updated on their end, but a user's DNS resolver is still using the old record.

                  2 votes
                  1. [2]
                    trim
                    Link Parent
                    Yeah I was getting standard ssl cert expiry errors at first, I think it was only after that was resolved maybe that the DNS went sus. Can just leave my vpn on until it works through. Browsing the...

                    Yeah I was getting standard ssl cert expiry errors at first, I think it was only after that was resolved maybe that the DNS went sus. Can just leave my vpn on until it works through.

                    Browsing the standard web with a vpn on though, is horrid in the extreme, I frequently get trapped in CAPTCHA loops on sites where I never see them before :(

                    2 votes
                    1. cfabbro
                      Link Parent
                      That depends entirely on the VPN. I pay for 2 dedicated, residential IP addresses (1xUK, 1xUS) with my VPN and never have any issues. ;) But yeah, browsing using public or shared IP pool VPNs is a...

                      That depends entirely on the VPN. I pay for 2 dedicated, residential IP addresses (1xUK, 1xUS) with my VPN and never have any issues. ;) But yeah, browsing using public or shared IP pool VPNs is a bit of a PITA because of that.

                      2 votes
      3. [6]
        trim
        Link Parent
        Okay here's the page source , I get this on my desktop browser , though it doesn't show any actual content <!doctype html> <html...

        Okay here's the page source , I get this on my desktop browser , though it doesn't show any actual content

        <!doctype html>
<html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_C2myAsoOMRz4Xw5rf2WZpueuiXGnQzm1hBMlfI3u7MzJZdZ9tTbKfb1YTJHc/hILYdAJ5SHUWx62ePM7Jx7NGg==" lang="en" style="background: #2B2B2B;">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC">
    <link rel="preconnect" href="https://www.google.com" crossorigin>
</head>
<body>
<div id="target" style="opacity: 0"></div>
<script>window.park = "eyJ1dWlkIjoiYmYzNmE4YjUtNzkxZS00MTc1LWIwM2UtY2FmMjM0NTU2ZTBiIiwicGFnZV90aW1lIjoxNzU0NjY3NjAzLCJwYWdlX3VybCI6Imh0dHBzOi8vdGlsZGVzLm5ldC8iLCJwYWdlX21ldGhvZCI6IkdFVCIsInBhZ2VfcmVxdWVzdCI6e30sInBhZ2VfaGVhZGVycyI6e30sImhvc3QiOiJ0aWxkZXMubmV0IiwiaXAiOiI4MS4xODcuMzYuMTE0In0K";</script>
<script src="/bYRvDxOZU.js"></script>
</body>
</html>

        I get this page when I look on my phone

        https://ibb.co/Jjp8HvS6

        Hope that encoded script thing has no PII in it. Can't fathom how to decode that, it's not base64

        4 votes
        1. [2]
          Bwerf
          Link Parent
          Maybe run nslookup tildes.net as well from a command prompt.

          Maybe run nslookup tildes.net as well from a command prompt.

          1 vote
          1. trim
            Link Parent
            This: nslookup tildes.net Non-authoritative answer: tildes.netcanonical name = 77980.bodis.com. Name:77980.bodis.com Address: 199.59.243.228 Whereas on vpn I get Non-authoritative answer:...

            This:

            nslookup tildes.net

            Non-authoritative answer:
            tildes.net canonical name = 77980.bodis.com.
            Name: 77980.bodis.com
            Address: 199.59.243.228

            Whereas on vpn I get

            Non-authoritative answer:
            Name: tildes.net
            Address: 54.39.49.122

            2 votes
        2. [3]
          cfabbro
          (edited )
          Link Parent
          Ah, okay thanks. It's just the standard Namecheap parking page. I was worried it was an ISP injected parking page or something else entirely. If you try changing your DNS settings to Cloudflare...

          Ah, okay thanks. It's just the standard Namecheap parking page. I was worried it was an ISP injected parking page or something else entirely. If you try changing your DNS settings to Cloudflare (1.1.1.1, 1.0.0.1) or Google (8.8.8.8, 8.8.4.4) does that resolve the issue? I suspect it will given activating your VPN fixes it too. So it's probably just that your ISP has very slow DNS record propagation. :/

          1 vote
          1. [2]
            trim
            Link Parent
            I’ll try that. I wanted to point out that Three Cheers on iPhone doesn’t work either My self hosted vps vpn in Finland doesn’t work either, but Mullvad to Switzerland fixes it

            I’ll try that. I wanted to point out that Three Cheers on iPhone doesn’t work either

            My self hosted vps vpn in Finland doesn’t work either, but Mullvad to Switzerland fixes it

            1 vote
            1. cfabbro
              (edited )
              Link Parent
              If you're desperate to get Three Cheers working again more quickly, you can change your DNS in iOS; Settings -> Wifi -> click (i) next to your router name -> Configure DNS -> Manual -> Add 1.1.1.1...

              If you're desperate to get Three Cheers working again more quickly, you can change your DNS in iOS; Settings -> Wifi -> click (i) next to your router name -> Configure DNS -> Manual -> Add 1.1.1.1 and 1.0.0.1 or whichever you prefer.

              That won't help you when using cellular data though, unfortunately, since AFAIK you can't manually change the cellular DNS resolver in iOS Settings. But you can download the 1.1.1.1 app or any other similar app (e.g. NextDNS, DNS Override, etc), which should override both your wifi and cellular data DNS. They're way more convenient than manually changing the DNS as well, since it usually just takes a single click in the app to enable/disable them.

              1 vote
  7. [2]
    tauon
    Link
    Who needs the s in https anyway, right? /s Edit: From the linked Let’s Encrypt article, Knowing nothing about the topic, I’m assuming 1 subdomain = 1 certificate? Or are there more specific...

    Who needs the s in https anyway, right? /s

    Edit: From the linked Let’s Encrypt article,

    Red Sift’s monitoring service providing expiration emails is free of charge for up to 250 certificates.

    Knowing nothing about the topic, I’m assuming 1 subdomain = 1 certificate? Or are there more specific requirements/scenarios?

    4 votes
    1. slade
      Link Parent
      You can create wildcards one level deep. So a cert can work for *.tildes.net, but not ..tildes.net.

      You can create wildcards one level deep. So a cert can work for *.tildes.net, but not ..tildes.net.

      6 votes