Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Recently Windows Azure Storage SSL certificate unexpectedly expired and since a lot of dependent services defaulted to "refuse to connect to a site with expired SSL certificate" that became a serious problem.

Now the SSL certificate of any web service can be retrieved by anyone at any time for validation. The picture is from the linked to question:

cert expired

So it means that the information was available at all times to "anyone it might concern" and any user of the service could have noticed the upcoming expiration and for example post a message on Microsoft forums before it was too late.

However I can't find any information about how such cases are typically handled except this question for doing that in code.

Is there any kind of best practice for validating third party services SSL certificates? What tools are typically used?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you are one such user, and run a Nagios/Icinga installation already anyway, there's a check to warn before a certificate expires.

This is what we use at work.

You'll “just” have to enumerate (by virtual host / server hostname) all those external services your things depend on (and keep that list up-to-date, which may not be as easy as it sounds).

share|improve this answer

I have a Ruby library I'm open-sourcing to enable this with TDD – Test Driven Devops. I'm making a Python version as well. Here's how it looks, testing a web app in Ruby:

require 'spec_helper'

describe 'My app' do
  it 'is configured for ssl' do
    # New-style RSpec syntax
    expect('www.myapp.com').to have_a_valid_cert

    # Old-style RSpec syntax
    'www.weblaws.org'.should have_a_valid_cert
  end
end

My idea is that these tests can be run periodically, say every five minutes, and notify on error.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.