This is what happens when your SSL\/TLS certificate expires<\/h2>\n\n\n\n
We talk all the time about what happens when your SSL\/TLS certificate expires<\/a>. We toss out high profile examples like Ericsson<\/a>, Equifax<\/a>, LinkedIn<\/a>, Cisco<\/a>\u2014you name it. Most of those cases were a result of negligence or oversight. <\/p>\n\n\n\n This, however, is a direct result of the current US government shutdown.<\/p>\n\n\n\n We already talked, earlier this week, about how catastrophic this shutdown was going to be to the US Cybersecurity apparatus long-term<\/a>. That\u2019s because, much like the 2013 shutdown did with the NSA, this is going to dissuade the best and the brightest from taking a government job instead of heading to the far more lucrative private sector.<\/p>\n\n\n\n But, there are still some employees that have stayed on to handle the \u201cessential\u201d functions required for cyber defense. Apparently, certificate management was not considered an essential function, which is why \u2013 according to Netcraft<\/a> \u2013 over 80 SSL\/TLS certificates have expired since the shutdown.<\/p>\n\n\n\n …the hundreds of thousands of unpaid federal employees might not be the only ones hurting. As more and more certificates used by government websites inevitably expire over the following days, weeks \u2014 or maybe even months \u2014 there could be some <\/p>\n\n\n\n As you no doubt are aware, HSTS or HTTP Strict Transport\nSecurity, is a security header that forces browsers to only attempt HTTPS\nconnections. Or to put it another way, it eliminates the ability for anyone to\nmake non-encrypted HTTP connections with your site.<\/p>\n\n\n\n Unfortunately, there\u2019s a tiny little window where an\ninternet user is vulnerable. It exists on the very first visit to a given\nwebsite, before the header has been downloaded. To close this window, many\nsites, like the Department of Justice\u2019s, add themselves to the HSTS preload\nlist. Browsers know to only make secure HTTPS connections with any site on the\nlist, even if the users has never visited it before.<\/p>\n\n\n\n You can probably see where this is going\u2026 ows2.usdoj.gov, is a DOJ website with an SSL\/TLS certificate that expired on Dec. 17. It has not been renewed. The site is down and cannot be reached. That\u2019s actually not the worst thing in the world, and it\u2019s far more secure than finding a way to connect via HTTP.<\/p>\n\n\n\n Ironically, the government\u2019s own ineptitude has saved some websites\nfrom HSTS pitfall.<\/p>\n\n\n\n\n
The HSTS Preload List is not helping in this case<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/01\/usdoj-1024x610.png\")
<\/figure>\n\n\n\n\n