GitHub's User Content certificate has expired

The cert for objects.githubusercontent.com has also expired:<p><pre><code> $ openssl s_client -connect objects.githubusercontent.com:443 CONNECTED(00000005) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = &quot;GitHub, Inc.&quot;, CN = *.github.io verify error:num=10:certificate has expired notAfter=Mar 21 23:59:59 2023 GMT verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = &quot;GitHub, Inc.&quot;, CN = *.github.io notAfter=Mar 21 23:59:59 2023 GMT verify return:1 --- Certificate chain 0 s:C = US, ST = California, L = San Francisco, O = &quot;GitHub, Inc.&quot;, CN = *.github.io i:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 1 s:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA </code></pre> What are the odds this happens the same day they rotate their SSH keys?

They&#x27;re serving the wrong cert on pkg-containers.githubusercontent.com (it&#x27;s for *.githubassets.com) and their support site also expired 3&#x2F;21... <a href="https:&#x2F;&#x2F;support.github.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;support.github.com&#x2F;</a> What is going on over there?

Still some weird stuff around (* subject: CN=apistatus.chorus.co.nz).<p><pre><code> curl https:&#x2F;&#x2F;www.githubstatus.com&#x2F; -vvvv -I \* Trying 52.215.192.131:443... \* Connected to www.githubstatus.com (52.215.192.131) port 443 (#0) \* ALPN: offers h2 \* ALPN: offers http&#x2F;1.1 ... \* SSL connection using TLSv1.3 &#x2F; AEAD-AES256-GCM-SHA384 \* ALPN: server accepted h2 \* Server certificate: \* subject: CN=apistatus.chorus.co.nz \* start date: Mar 6 23:10:30 2023 GMT \* expire date: Jun 4 23:10:29 2023 GMT \* subjectAltName: host &quot;www.githubstatus.com&quot; matched cert&#x27;s &quot;www.githubstatus.com&quot; \* issuer: C=US; O=Let&#x27;s Encrypt; CN=R3 \* SSL certificate verify ok. \* Using HTTP2, server supports multiplexing</code></pre>

Here is the report for this incident: <a href="https:&#x2F;&#x2F;www.githubstatus.com&#x2F;incidents&#x2F;x7njwb481j9b" rel="nofollow">https:&#x2F;&#x2F;www.githubstatus.com&#x2F;incidents&#x2F;x7njwb481j9b</a>

EDIT: this specific issue is resolved<p>Failing for us in GitHub Actions<p>For SEO purposes:<p><pre><code> npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! errno ERR_TLS_CERT_ALTNAME_INVALID npm ERR! request to https:&#x2F;&#x2F;pkg- npm.githubusercontent.com&#x2F;npmregistryv2prod&#x2F;blobs&#x2F;\*\* failed, reason: Hostname&#x2F;IP does not match certificate&#x27;s altnames: Host: pkg-npm.githubusercontent.com. is not in the cert&#x27;s altnames: DNS:\*.githubassets.com, DNS:githubassets.com</code></pre>

This also applies to their avatars subdomain, causing them not to load anymore.

I wonder if this has anything to do with the recent SNAFU from a Senior Security Engineer* there?<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;viibeeng&#x2F;status&#x2F;1639374358287118336" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;viibeeng&#x2F;status&#x2F;1639374358287118336</a><p>(*yeah we can all make mistakes, but it&#x27;s 2023, if you&#x27;ve not build controls into your workflows by now you don&#x27;t deserve to be a Senior anything)

I built a free monitoring service some years ago if anyone doesn&#x27;t want to be the victim of this...<p><a href="https:&#x2F;&#x2F;ismycertexpired.com&#x2F;check?domain=objects.githubusercontent.com" rel="nofollow">https:&#x2F;&#x2F;ismycertexpired.com&#x2F;check?domain=objects.githubuserc...</a>

It looks as though it&#x27;s back for me now. Status page is now showing the problem: <a href="https:&#x2F;&#x2F;www.githubstatus.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.githubstatus.com&#x2F;</a>

Also serving wrong certificates for a lot of content domains.<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35295191" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=35295191</a>

Sounds like whoever is in charge of certificates at GH must have come over from MSFT. Afterall, I think Microsoft has had 2-3 certificate expiry issues in the last several years.

And today of all days I have a moment to upgrade homebrew stuff.

got a &quot;RequestError: certificate has expired&quot; doing a release just now...as usual, not a good idea to release on a friday

Previously I had the same issue, but it works for me now, as well as for a friend in another EU country.

For us dumb dumbs what does this mean?

Seems to be resolved now. My `brew update` works again.

ChatGPT, rotate my certs

Well I&#x27;m kind of just waiting on PRs for the rest of the day today and it&#x27;s a Friday, so I&#x27;ll consider this a modern equivalent of <a href="https:&#x2F;&#x2F;xkcd.com&#x2F;303&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;303&#x2F;</a>

It&#x27;s back now!

didn’t they announce a bunch of layoffs recently?

Back up now, it looks like.

Not Before Fri, 18 Mar 2022 00:00:00 GMT<p>Not After Tue, 21 Mar 2023 23:59:59 GMT<p>3-day certs.