Expired certificate on hosted version of aeternal.io

hiciu · June 16, 2020, 4:31pm

Hi,

https://mainnet.aeternal.io/ responds sometimes with this certificate:

~> certtool --certificate-info
...
X.509 Certificate Information:
        Version: 3
        Serial Number (hex): 03503b05f86d1b94e5fb13f9f993d1ce25fa
        Issuer: CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US
        Validity:
                Not Before: Wed Mar 18 12:31:38 UTC 2020
                Not After: Tue Jun 16 12:31:38 UTC 2020
...

I would say once in about 10 tries I’m receiving that expired cert:

~> for i in (seq 1 20); curl -s https://mainnet.aeternal.io/robots.txt -o /dev/null -w 'ip: %{remote_ip}, ssl verify: %{ssl_verify_result}\n'; sleep 2; end
ip: 195.201.174.46, ssl verify: 10
ip: 195.201.174.46, ssl verify: 0
ip: 195.201.174.46, ssl verify: 0
ip: 195.201.174.46, ssl verify: 0
ip: 195.201.174.46, ssl verify: 0
ip: 195.201.174.46, ssl verify: 10
ip: 195.201.174.46, ssl verify: 0
ip: 195.201.174.46, ssl verify: 0
ip: 195.201.174.46, ssl verify: 0
...

dimitar.chain · June 17, 2020, 9:44am

I think @dincho.chain is already on it.

dincho.chain · June 17, 2020, 12:44pm

Hi, thanks for reporting.

I was able to reproduce it. It was weird issue, my blind shot would be that the certificate was auto-renewed yesterday and certbot is doing apache reload instead of restart, which left a cached old certificate in the master process. I just did restart and that seems so solve it for me, I’m not able to reproduce it anymore.

Could you please try to reproduce it again on your end?

Again, thanks for the detailed report, I really appreciate it.

Also, please use https://mainnet.aeternity.io instead.

hiciu · October 15, 2020, 12:14pm

Hello :).

I would like to report that this issue has occurred again - it seems that once every couple connections I’m getting response with expired certificate (only for *.aeternal.io version).

For *.aeternity.io version once every couple requests I’m getting 502 from cloudfront - if I had to guess it uses the same backend. Although it is a lot harder to reproduce on the *.aeternity.io version. I have managed to catch one 502 from cloudfront with firefox, after multiple tries.

Thank you for maintaining aeternal and keeping that public instance alive, it makes interacting with aeternity blockchain a lot easier (in comparison to other blockchains).

dimitar.chain · October 16, 2020, 7:10am

I guess cc @karol.chain