Recently Windows Azure Storage SSL certificate unexpectedly expired and since a lot of dependent services defaulted to “refuse to connect to a site with expired SSL certificate” that became a serious problem.
Now the SSL certificate of any web service can be retrieved by anyone at any time for validation. The picture is from the linked to question:
So it means that the information was available at all times to “anyone it might concern” and any user of the service could have noticed the upcoming expiration and for example post a message on Microsoft forums before it was too late.
However I can’t find any information about how such cases are typically handled except this question for doing that in code.
Is there any kind of best practice for validating third party services SSL certificates? What tools are typically used?
1
If you are one such user, and run a Nagios/Icinga installation already anyway, there’s a check to warn before a certificate expires.
This is what we use at work.
You’ll “just” have to enumerate (by virtual host / server hostname) all those external services your things depend on (and keep that list up-to-date, which may not be as easy as it sounds).
I have a Ruby library I’m open-sourcing to enable this with TDD – Test Driven Devops. I’m making a Python version as well. Here’s how it looks, testing a web app in Ruby:
require 'spec_helper'
describe 'My app' do
it 'is configured for ssl' do
# New-style RSpec syntax
expect('www.myapp.com').to have_a_valid_cert
# Old-style RSpec syntax
'www.weblaws.org'.should have_a_valid_cert
end
end
My idea is that these tests can be run periodically, say every five minutes, and notify on error.