back to article Apple's OS X App Store downloads knackered by expired security cert

A forgotten security certificate renewal appears to be behind a series of failed downloads from Apple's App Store. Overnight, users who downloaded Mac apps from the firm's online storefront found they couldn't open the software. The problem appears to be a software certificate – designed to thwart piracy and verify programs …

  1. Anonymous Coward
    Anonymous Coward

    Google's resources aren't quite as vast as Apple's, but they could also afford to have someone keep an eye on this stuff and have had the same thing happen to them.

    The company I'm consulting for at the moment has had this happen to them, so their solution was to choose the expiration date each year so they all expire at the same time. Hopefully that is easier to remember, but if they ever forget it will cause a lot more havoc than one service being offline!

    1. Charlie Clark Silver badge

      @Apple's number one shareholder: I've read the article several times and I still can't find a reference to Google so why the swipe?

      This was a SNAFU and Apple should try and learn from it. An apology to users and developers would be a start.

      1. Anonymous Coward
        Anonymous Coward

        The article said it has happened with others but implied that since Apple has so much money they should be able to afford someone to manage this process. I mentioned Google (who are not poor themselves) since I recall they were recently bit with the same problem:

        http://www.pcworld.com/article/2906216/expired-google-certificate-temporarily-disrupts-gmail-service.html

        1. Charlie Clark Silver badge

          The article said it has happened with others but implied that since Apple has so much money they should be able to afford someone to manage this process.

          And as a shareholder you obviously think there's something wrong implying this? Damn right Apple should be doing a better job for its paying customers and developers!

          1. Danny 14

            Im surprised apple don't self sign 25 year certs and have a root CA on each device for apple :-)

  2. NoneSuch Silver badge

    Apple has banned devs for reporting negative facts in public before. Good luck to Paul Haddad.

  3. Anonymous Coward
    Anonymous Coward

    This is why the....

    whole certificate concept is flawed.

    IMHO when you buy something, it should be yours FOREVER no matter what that item may be,

    NOT "disabled" by the whims of an inattentive "administrator" who forgot the renew a certificate!

    This is the same for any and all DRM schemes. If they take the server down, do your rights expire?

    Not LEGALLY.........if you paid for something, you own it.

    1. John H Woods Silver badge

      Re: This is why the....

      " This is why the whole certificate concept is flawed" -- AC

      There are some problems with certificates, but expiry isn't really one of them. It's nothing like DRM orphans; certificate expiry is virtually a cryptographic necessity.

      There's a lot of dates companies need to remember: tax returns, profit filings, public holidays, audit points, backup schedules, etc. etc. --- it's really not too onerous to track certificate expiry dates.

      1. Anonymous Coward
        Anonymous Coward

        Re: This is why the....

        Not if the cert issuer goes out of business. If I have usable software that I paid for and the manufacturer no longer provides support because they are gone why should I suffer because the software requires that it validate itself online on a now non existent server?

        Manufacturers should be required to offer a way to remove the need for validation of said software or media before they can leave the business.

        1. Kevin McMurtrie Silver badge

          Re: This is why the....

          This happened to DIVX video discs when DRM owner Circuit City failed. It happens when DRM controlled electronics are given a forced update and the DRM controlled media/app is no longer compatible. Anyone using permissions based DRM should be forced to call it a lease or a long-term rental rather than a purchase. I believe this is a large driving force behind the race to the bottom in online purchases. The price that I will accept for DRM purchases is based on my expectations of a 3 month lifespan.

    2. Adam 1

      Re: This is why the....

      If you want to be technical, if you pay for something, you licence the right to use it, but your suggestion is one of those medicine is worse than the disease things.

      Breaking a sha1 cert costs about 75K in today's money. In 5 years or so, it will drop to about 5K (assuming no new weakness is found in the meantime that makes it even cheaper; a brave assumption). I find it a good thing that the certificates my bank was using 10 years ago will be rejected.

      Also, why are you using the vendors' certificates if you own both client and server parts of the software? Just buy your own and then you can carry on renewing your software certificates long after whatever vendor joins the long list of "remember thems". (Setting aside the wisdom of using software that can never be patched)

      1. TeeCee Gold badge

        Re: This is why the....

        Mostly correct, but the banking example you use nicely proves where the fuckup really is.

        Having a "hard" expiry date is both unnecessary and daft. A warning window of several months (This one's getting on a bit, feel free to continue, but you might want to drop a line to the site's admins and remind them) before calling it as dead would be far more sensible.

        The only difference between a valid cert and an expired one is usually the odd day. Does that affect it's security? No, it doesn't.

        1. Ben Tasker

          Re: This is why the....

          Having a "hard" expiry date is both unnecessary and daft. A warning window of several months (This one's getting on a bit, feel free to continue, but you might want to drop a line to the site's admins and remind them) before calling it as dead would be far more sensible.

          Sane admins have checks in place that provide that warning window, it's no harder than having a script (say, a Nagios check?) connect to a service periodically and warn if the certificate will expire in less than n days.

          If browsers implemented a "warn if cert has < 14 days" then I'd need to change my checks to check for a longer period (say 30 days) if I don't want my users to see nag warnings. So, it wouldn't really change the position someone who's thought it through should be in.

          If we go your way, and extend some grace-time afterwards (lets say 2 months). That's 60 days where my compromised cert can still be used. We renew certificates (more importantly, the private key) because the key may have been compromised without our knowledge, so what you're doing is extending the opportunity time for anyone that has laid hands on it.

          Certificates expire, so you should note the expiration date, and put a failsafe in place to warn you sufficiently in advance of expiration. Neither of which requires changes to how certificates work.

          1. Anonymous Coward
            Anonymous Coward

            Re: This is why the....

            "That's 60 days where my compromised cert can still be used."

            If your certificate had been compromised, you'd revoke it. TeeCee is talking about the date based expiry, which if in date, your compromised certificate could still be used for potentially years unless you revoke it.

            1. Ben Tasker

              Re: This is why the....

              @AC

              I did say if you did not know it had been compromised. That's the reason we cycle keys at renewal time, stretching the window of validity because people do a crap job of monitoring their infrastructure is not the solution.

              1. Anonymous Coward
                Anonymous Coward

                Re: This is why the....

                "I did say if you did not know it had been compromised" - well if you don't know about it, you're shafted either way, because even with a yearly renewal, you could still be running a compromised cert for a year.

                Revocation is the way to go if you know, relying on date based expiry simply isn't secure as a "catch it if I can't" feature for the reason above and you haven't addressed the cause of the breach that compromised the former cert so there is no reason the new certificate won't be compromised either.

                The real reason for date based expiry is so CAs can milk us annually.

    3. Amorous Cowherder
      Stop

      Re: This is why the....

      Cert problems aside, you NEVER, EVER own software, you merely buy the rights to use it. With OSS you are granted rights to use it but simply paying and/or downloading, buying a DVD or USB with said software on does NOT mean you own it, simply the media it comes on. If I wish, as owner of the software, I can revoke that right to use it providing I made that clear in the EULA, which of course we all read from beginning to end before we open/install software!

      If you buy a book you have purchased rights to read it as often as you wish but you do not technically own the book. I have to sell you the media ( the paper, card, plastic cover ) 'cos you can't read the book without the medium it comes in, but technically you will never own the book. That's why so many lawyers want to ban second sales on games and books, they see a second sale as a loss as you have no right to make money from someone else's work, you can argue that one as you wish!

  4. frank ly

    Calendar, Events, Alarms, Alerts, Notifications

    Isn't there an app for that?

    1. Scroticus Canis
      Unhappy

      Re: Calendar, Events, Alarms, Alerts, Notifications - " Isn't there an app for that?"

      Yes there is but whoever set the reminder probably just "upgraded" to El Crapitan™ and lost all their calendar entries like I did (tabula rasa). At least Time Machine worked and back on Mavericks again.

      1. Lallabalalla

        Re: Calendar, Events, Alarms, Alerts, Notifications - " Isn't there an app for that?"

        You don't even need to do that for calendar etc to lose stuff. It happens randomly anyway, because reasons.

        Infuriates the hell out of me.

  5. Nate Amsden

    haha

    That's nothing. One cert expired? Pfft. I remember what was it 2004 perhaps a big CA expired. News was coming for years this cert was going to expire. I was working at a company with nextel as one of our clients. They had outsourced much (all? I don't know) IT to IBM global services. This cert expires and from what was explained to me is virtually every single cert at nextel was hit as a result. All certs went bad globally at the same time. It was pretty amusing. I don't remember how long it took them to recover.

  6. Charlie Clark Silver badge
    Megaphone

    Broken for longer than that

    My app store account has been broken since September: apps which require a login (including XCode) start to download and then fail with a poorly translated error message.

    The messages in syslog look suspiciously like authentication failures. I've spent over an hour on the phone with Apple's always polite support and have even run a system trace and provided the dump. Silence thus far from the fruity ones but it looks like this evening the problem has been resolved. Coincidence?

  7. Oengus

    Resources

    "But you'd have thought a company with the vast resources of Apple could assign someone to keep an eye on such things."

    They have millions of unpaid resources to do their work for them. The fanbois will notify Apple that something is not working. Why pay for something that you get for free - it helps improve the company bottom line.

    1. chivo243 Silver badge

      Re: Resources

      Yes, yes, plenty of fanbois, but none of them charged with specifically keeping tabs on the certs...

      Not having someone who's job it is to maintain these certs can also affect the company's bottom line when the appstore is fubar.

    2. Lallabalalla

      Re: Resources

      Yes they do. SO unlike Microsoft who have literally no users, sysadmins or anybody else anywhere in the world who would start to bleat if something big didn't work.

  8. J.G.Harston Silver badge

    I keep getting "invalid security certificate" warnings when I come to The Register, and most of the images refuse to download. Pot Kettle?

    1. VinceH

      Pot Kettle?

      Not really, no. There's a big difference between not having (and not claiming to have) a certificate to start with and having one, making things rely on it, then letting it expire.

    2. Lallabalalla

      "invalid security certificate" warnings when I come to The Register

      I bet you're using Firefox.

  9. Alister
    Facepalm

    But you'd have thought a company with the vast resources of Apple could assign someone to keep an eye on such things.

    Umm, I would argue that in a company of Apple's size, (or Google, or Microsoft, or Facebook) then it's likely to always be someone else's job, whereas in a small company it will definitely be assigned to a single individual.

    And even then, it's possible to miss one... ask me how I know...

    1. Brewster's Angle Grinder Silver badge

      Upvoted for having the courage to admit it. We seem to have become a very self-righteous and unforgiving crowd.

  10. Yugguy

    Billion dollar company

    And noone's monitoring expiry dates.

    Abysmal

    1. Brewster's Angle Grinder Silver badge

      Re: Billion dollar company

      Well, the person who was monitoring it was off sick. Or was tending a sick relative. Or retired and the vacancy hasn't yet been filled. Or the person who took on the role didn't notice this certificate amongst their many other responsibilities. Or management didn't realise the certificate existed -- person X had created it, renewed it, and then wasn't around. Or whoever was responsible screwed up. (We've all been there -- forced to create a certificate which is soon forgotten because it was a 5 second job in yet another 12 hour day.)

      You don't get to be a billion dollar company by having someone sitting around doing nothing except monitoring certificates.

      Declaration: I have yet to forget to renew a domain or certificate. Yet.

      1. Mark 153

        Re: Billion dollar company

        Actually, they've probably got a whole team who do that sort of stuff. I'd imagine in India

        It's actually harder to keep track of this stuff if you're massive though because it's probably a pain to get a new cert from central certificate management, so devs do it on the sly and forget to tell anyone.

        Then it goes live to millions of people

  11. Impunitus

    No comment

    "Apple has no comment at time of publication."

    At least somebody hasn't missed the perfect opportunity to keep the mouth shut. A rare occurrence these days. Sadly, bound to change quickly, as it usually does.

    Cheers!

    1. Disko
      Pint

      Optional

      The post is required, and must contain letters.

  12. alpine

    I'm sure Steve Jobs put an entry in his diary.

    1. Anonymous Coward
      Anonymous Coward

      "I'm sure Steve Jobs put an entry in his diary."

      Sadly his certficate ran out too.

  13. DLKirkwood

    Steve Jobs WAS Apple

    I switched from PC to Apple in 2007. Was not happy with lack of phone support but once I taught myself Apply language, vs PC I loved all my apple products ! My computers never crashed, they were fast, I never had a problem.

    Then Steve died. Apple began falling apart. They introduced Lion, at a too good price to be true. My guy said RESIST, RESIST ! I didn't listen. Then Siri became more cheeky, took time off (just you needed her guidance) with a message, I can't help you now, I'm sorry. No explanation other than she was mourning for Steve. Lion teamed with Micro Soft's iCloud - Apples competitor - continued to reek havoc on my computer ... files disappeared, slow deliver of content, the difficultly of trying to keep my item ON my computer and out of some floating space up in the sky where potentially any hacker can grab and run.

    Now trapped in the world of indecision --- wait it out until Apples finds an intelligent CEO / COO with the desire to his best for disillusioned Apple loyals, or to jump ship and go back to buying the slightly less expensive PC's that seem to be working better these days and anti-virus software on a yearly basis that (in past) slowed down performance.

    On the very worse of days I long for the time live was simpler: a time one could phone the library to get information, and say real life kitty memes in action, and a time we had friends face to face (with bodies attached) and going to Dairy Queen, playing baseball in the park, meeting 'downtown' to just hang out and be 100% devoted to the others - not mobiles, iPads, or any such distractions. A time when life was much simpler, and far richer. But still....I miss you, Steve !

  14. Howard Hanek
    Happy

    Yes They Did Assign Someone.....

    " But you'd have thought a company with the vast resources of Apple could assign someone to keep an eye on such things."

    They did. Steve Jobs

  15. Nanners

    Been using apple

    Since 98'. Was learning apples in grade school when they indoctrinated the children early on. This is NOT apple

    Anymore. The should change the name at this point. They have totally screwed the software and no one is interested in that el crapitan. Too bad they are still a better choice then Windows. Someone who knows what the freak they are doing desperately needs to come on the scene and save humanity.

    1. Danny 14

      Re: Been using apple

      I remember one of my first jobs was an apple network back in 1992. SE10 server and 10 mac plus desktops. I remember upgrading the RAM and needed to knock a resistor to make the upgrade work. They did work quite well as a network.

      That being said there was no comparison as the PCs at the time were fairly "voodoo needed" machines (ISA cards including Tseng labs isa VGA).

  16. Jeffrey Nonken

    And so DRM one again proves its worth by shutting down paying customers while leaving the so-called pirates running without a hitch.

    This is why even legitimate, paying customers sometimes use cracked copies.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like