Microsoft failed to rotate certificates for winget CDN on time

I think the default certificate expiration time (2 years) is a terrible idea. Its long enough that there&#x27;s a good chance whoever registered the cert last time has left the team or the company. Its long enough that I&#x27;ve forgotten how to generate a certificate with openssl on the command line. And its long enough that each time, I (and everyone else) can justify not bothering to automate the process.<p>But 2 years is still short enough that if you have a couple domains, remembering to renew them is an ongoing hassle!<p>Letsencrypt certificates last 90 days, and they recommend renewing them every 60 days. This is a much better duration, because it encourages the entire ecosystem - developers and admins - to set up processes which automate renewal. And if the automated renewal process fails, letsencrypt starts emailing you about it to let you know your certificate is about to expire. (And you have enough time to fix it).<p><a href="https:&#x2F;&#x2F;letsencrypt.org&#x2F;2015&#x2F;11&#x2F;09&#x2F;why-90-days.html" rel="nofollow">https:&#x2F;&#x2F;letsencrypt.org&#x2F;2015&#x2F;11&#x2F;09&#x2F;why-90-days.html</a>

While I appreciate TLS, this thing with certificate expiration is one of the biggest sources of downtime IMO. Something should be done about it. May be throw error not permanently but in a some probabilistic way. Like if 1 year certificate expired, after 3 months 25% of connections would fail. It&#x27;ll allow eventually to find out about problem but it&#x27;ll allow for connections to somewhat work, with few retries here an there. Expired certificate is not compromised certificate and should not be treated like one. Often next certificate is issued with the same private key.<p>Especially with short-lived letsencrypt certificates. Despite all the evangelists assurances, certbot is not always easy to set up. After letsencrypt gained popularity, the percentage of small websites with expired certificates significantly increased IMO.

reminds me of that time the regular guy, might&#x27;ve been a student, re-registered hotmail.com just to get his email working again after Microsoft let it expire.<p>oh, looks like it was either hotmail.co.uk or passport.com<p><a href="https:&#x2F;&#x2F;slashdot.org&#x2F;story&#x2F;99&#x2F;12&#x2F;25&#x2F;114201&#x2F;microsoft-hotmailpassport-service-interruptedupdated" rel="nofollow">https:&#x2F;&#x2F;slashdot.org&#x2F;story&#x2F;99&#x2F;12&#x2F;25&#x2F;114201&#x2F;microsoft-hotmail...</a><p>from<p><a href="https:&#x2F;&#x2F;whoapi.com&#x2F;blog&#x2F;5-all-time-domain-expirations-in-internets-history&#x2F;" rel="nofollow">https:&#x2F;&#x2F;whoapi.com&#x2F;blog&#x2F;5-all-time-domain-expirations-in-int...</a>

Looking at crt.sh (<a href="https:&#x2F;&#x2F;crt.sh&#x2F;?q=cdn.winget.microsoft.com" rel="nofollow">https:&#x2F;&#x2F;crt.sh&#x2F;?q=cdn.winget.microsoft.com</a>), it seems that the certificate is issued automatically anyways but for some reason the updated certificate is not applied correctly. A bad screwup really, but more of did someone forget to check their logs for deployment errors rather than the common case of someone forgetting to manually update the certificate.

We&#x27;re working on renewing the certificate. It looks like this is the first report: <a href="https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;winget-cli&#x2F;issues&#x2F;2956">https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;winget-cli&#x2F;issues&#x2F;2956</a>

I think they&#x27;ve been bad stewards of that project since they stole it from that guy. it had promise but they refused to add basic features

Why would anyone standardize on winget when there&#x27;s chocolatey and it works everywhere you can run Windows software?<p>Recently I decided to install Windows Server on one of my PC instead of Windows 10&#x2F;11. I thought, why not attempt to use winget and&#x2F;or the Windows App Store to install basic software to see how far that takes me.<p>Immediate dead end. Apparently there&#x27;s no access from the App Store on Windows Server. You have to have your IT set it up. And all the documentation refer to using winget from the App Store. :&#x2F; Microsoft, I can&#x27;t even with you right now.<p>With Windows Server 2022, apparently you can get winget to work, but you have to install something else or other that&#x27;s in preview.<p>For real, guys. Please get with the program.<p>Possible workarounds: Anything that&#x27;s a workaround is already a non-starter for me because I&#x27;m not trying to experiment to see what I can get to work. I&#x27;m trying to move to using a new norm so I don&#x27;t get left behind. If Microsoft was pushing winget as the new norm for global silent command-line installations of all things Windows, as an alternative to Chocolately, great! I would have given it a try. Other than that, imma just wait until y&#x27;all get your act together, &lt;i&gt;someday-maybe&lt;&#x2F;i&gt;.

Microsoft&#x27;s certificate management skills have gone down the drain anyway, so this doesn&#x27;t surprise me. I have a long standing support case open with them about how they ship one of their more obscure tools signed with the wrong code signing certificate (one signed by their PKI for Azure INTERNAL usage, which should have everyone a tiny bit worried), and I&#x27;ve pretty much given up on trying to get the quite-obviously-on-an-H1B developer (which I mention only to explain that this PROBABLY leads to a perverse incentive to sweep things under the rug), or any of the Indian support agents involved to comprehend that this isn&#x27;t just inconvenient when one has AppLocker in place, but also that it violates Microsoft&#x27;s internal policies (which I know for a fact that it does), and MSRC ignored my email about it, too, so… par for the course. ¯\_(ツ)_&#x2F;¯

If only there was a cloud based solution by a large company for managing certificates automatically!<p>(Azure Front Door)

ITT: Lots of people feigning ignorance about how companies work, or have literally never worked for a large company before.<p>And hilariously thinking Microsoft would spin up a critical incident team for a free open-source product. I&#x27;m rolling on the floor laughing.

Aaaand it&#x27;s still not fixed. I think this just goes to show how much red tape there is around processes at Microsoft.

Amateurs.