Re: ARO Security

> (I think you need to send along: -servername) point % openssl s_client -servername secretariat.nanog.org -connect secretariat.nanog.org:443 CONNECTED(0003) depth=3 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority verify error:num=19:self signed

Re: ARO Security

of course, this begs the question of why one would try to go to https://secretariat.nanog.org/. it is published as a supported web site? randy

Re: ARO Security

On Mon, May 18, 2015 at 4:40 PM, Randy Bush wrote: >> let's take the conversation off of nanog to spare the list. > > one of the purposes of this list is for us to learn from eachother. in > this case, techniques for diagnosing tls & cert issues are worth > sharing. [ sadly, folk with bugs love

Re: ARO Security

On Mon, May 18, 2015 at 3:59 PM, Eric Oosting wrote: > On Mon, May 18, 2015 at 12:30 PM, Nicholas Schmidt < > nicholas.schm...@controlgroup.com> wrote: >> 2.) The SSL cert for secretariat.nanog.org is invalid. It looks to be >> trying to use the wildcard for amsl.com > > > I'm curious what is goin

Re: ARO Security

i too get the amsl cert in response to an opelssl cert query with a bog standard starfield class 2 chain % openssl s_client -connect secretariat.nanog.org:443 CONNECTED(0003) depth=0 /OU=Domain Control Validated/CN=*.amsl.com verify error:num=20:unable to get local issuer certi

Re: ARO Security

On Mon, May 18, 2015 at 12:30 PM, Nicholas Schmidt < nicholas.schm...@controlgroup.com> wrote: > I cant find a way to reach out to whoever manages ARO directly so I figure > it would be best to publish this to the list. > Nicholas, It's normally a good idea to email any questions you have to nan

ARO Security

I cant find a way to reach out to whoever manages ARO directly so I figure it would be best to publish this to the list. We are a group of network operators who are failing at enforcing extremely basic security in our own applications. 1.) Retrieving an ARO password sends a plain text email of yo