Starlink, a satellite internet constellation service operated by SpaceX, encountered a critical outage caused by an expired ground station certificate, as Elon Musk stated in his tweet (see below). The expired certificate caused the system/service to have an outage. Even if the service is set up with high availability typically they would be using a single identity which could have been the case here. That certificate was tied to a specific internet application/service and would have had no impact on other applications/services with valid certificates, which is why Elon Musk mentioned “single point vulnerability” in his tweet.
Expired digital certificates wreaking havoc on the availability and security of internet applications and services isn’t new. Even the most well-known and largest tech companies, like Google and Microsoft, are not immune to the dangers posed by expired certificates. Undocumented certificate installations and unexpected certificate expirations result in critical interruptions and service outages that negatively impact an organization’s reputation and result in significant financial losses.
The most feared side effects of certificate expiry are increased security risks, unplanned application downtime, and the browser warnings that come with them, which can ultimately drive away customers. Certificate expiry isn’t a problem in itself – certificates are intended to expire however, new certificates must be issued and properly provisioned in place of expired certificates in order to ensure applications remain secure and functional. The outage issue occurs when organizations fail to renew certificates on time. This can happen when organizations lack visibility into certificate infrastructure, manage certificates using error-prone manual processes, and do not implement automation efficiently. The 2022 State of Certificate Lifecycle Management in Global Organizations, a study commissioned by AppViewX and conducted by the Ponemon Institute, revealed that 64 percent of respondents mentioned that their organizations are unaware of the exact number of certificates due to a lack of a centralized inventory, and 41 percent of respondents noted that their organizations track certificates manually.
Digital certificates, like Secure Socket Layer (SSL)/Transport Layer Security (TLS) certificates, are frequently used by businesses for trust, integrity, encryption, and authentication. They are essential for providing safe and reliable communication between servers, devices, and applications. These certificates must be continuously monitored, tracked, renewed, and re-provisioned on time since they are issued with a set validity period that cannot be changed or extended. The fixed lifespan of certificates, particularly for publicly trusted TLS/SSL, mitigates the risk of certificate abuse or key compromise by threat actors.
If a TLS certificate expires, the internet-facing application/website will not be secure, trusted, or in some cases accessible – causing a service outage and potentially worse, an insecure attack vector. Certificates require regular monitoring, maintenance, and rotation. For private trust certificates, organizations can set more flexible validity periods and expiration dates. Regardless, it is best practice to refresh certificates and keys frequently in order to ensure a strong security posture. This includes renewing and reissuing certificates frequently. In the event that certificates are not properly tracked, managed, and renewed, they expire and knock the workloads, devices, or applications offline.
While Google’s proposal to reduce the maximum validity period for public TLS certificates from 398 days to 90 days can be beneficial from a security standpoint, this change would also mean ‘more frequent renewals.’ With a validity period of a mere three months, public TLS certificates will require renewals not once but four times a year! Managing certificate expirations through spreadsheets and reminder notifications and then manually renewing and re-installing certificates is no longer a practical strategy due to the shortening of certificate validity. These are time-consuming and tedious operations that are prone to human error. Certificate management requires meticulous attention that is difficult to maintain at scale in order to adhere to evolving industry standards and keep up with technological advances in hardware and software.
Critical Role of Digital Certificates
X.509 certificates are digital certificates, comprised of public and private key pairs, that use the widely accepted X.509 public key infrastructure (PKI) standard. They serve the authentication and encryption needs of web-application systems, mobile and IoT devices, and others.
SSL/TLS certificates are one of the most common types of X.509 certificates and are used to verify a website’s identity and establish an encrypted network connection, resulting in secure communication. SSL/ TLS certificates link an associated owner—which may be a host, domain, or server—with a public key. Publicly trusted SSL/TLS certificates that are issued by third-party, trusted Certificate Authorities (CAs) are accepted by operating systems and browsers worldwide and provide a foundation of trust on the internet.
PKI and Certificate Management: 7 Reasons Why It Is Challenging
Mismanagement of Digital Certificates
Digital certificates must be monitored, managed, and renewed due to their restricted lifespans in order to prevent expensive application outages. Any inaccuracy or oversight in terms of critical certificate details, such as the expiration date, ownership, or device information, can make it challenging to guarantee a timely renewal before the internet application/service is forced offline. And, when the number of certificates in an infrastructure increases, so does the risk of experiencing unplanned certificate related outages.
Here are some of the factors contributing to certificate mismanagement:
- Poor visibility: Lack of sufficient visibility into all certificates and the crucial certificate information such as location on a network, when it expires, the CA that issued it, and the endpoint(s) it is tethered to, make it difficult for organizations to monitor certificate status, remediate issues, and prevent applications outages and data breaches.
- Tedious manual processes: Manually managing certificate lifecycles using homegrown solutions is slow, error-prone, and inefficient. Manual certificate enrollment and provisioning stall applications and devices from going online quickly, while manual renewal, revocation, and auditing can potentially cause downtime outages and security weaknesses. The management of thousands to hundreds of thousands of public and private trust certificates with various expiration dates issued by internal and external Certificate Authorities (CAs) adds to the complexity.
- Lack of crypto-agility: Manual processes do not support crypto-agility. Manually upgrading infrastructure or reissuing certificates en masse takes significant time, careful planning, coordination, and execution, which results in delayed remediations and leaves vulnerable certificates susceptible to attacks for long periods of time. Another drawback with manual processes is the lack of insight and control over the crypto standards used with certificates and keys, which also makes it difficult for organizations to proactively detect vulnerabilities and act upon them quickly.
- Challenges with cloud security: Discovering the increasing volume of certificates distributed in multi-cloud, dynamic DevOps, and IoT environments is beyond the scope of legacy monitoring tools and manual processes. This leads to certificates going undocumented and unmonitored, which in turn become easy targets for attackers. Monitoring and tracking all the certificates that were issued, renewed, and revoked across different cloud environments via spreadsheets leaves many loopholes in certificate management, putting enterprise security and operations at high risk.
Impact of Unexpected Certificate Expiry
We have identification documents with predetermined expiration dates, such as driver’s licenses and passports, to guarantee human identity. When a document has passed its expiration date, it is regarded as invalid and is no longer accepted as a trusted form of identification. Digital certificates, such as TLS/SSL certificates and X.509 certificates, are available to provide identities for machines (devices and workloads) and serve a similar purpose. Let’s see what happens when these digital certificates expire.
- Unplanned outages: A system’s inability to carry out its primary operation is referred to as an outage or unplanned downtime. The system might be offline, temporarily unavailable, or unable to function completely due to an expired certificate. Missed certificate renewals pave the way for application downtime and outages, as Starlink faced. Digital certificates that are no longer valid can disrupt operations and negatively impact an organization’s security posture.
- Exposure to security vulnerabilities and cyberattacks: Expired certificates that don’t adhere to security standards are the entrance to the corporate network, and hackers are constantly searching for such loopholes to take advantage of. Severe security flaws, such as phishing scams, SSL stripping, Poodle, FREAK, man-in-the-middle (MITM), and other sophisticated malware attacks, might expose your network. Most organizations have migrated to hybrid, multi-cloud, and perimeter-less networks, yet they are still having trouble keeping track of the numerous digital certificates. Dangerous cybercriminals are launching more advanced assaults as a result of the rise in encrypted communications by capitalizing on the chaos of managing a multitude of digital certificates.
- Loss of customer trust: Customer trust is severely harmed by an unresponsive website that is displaying security warnings due to an expired certificate. When users visit a website using an expired certificate, they are presented with warnings that read “this site is not secure”, “connection is not private”, “attackers might be trying to steal your information” etc. With these severe warning signs, users will no longer trust the website, despite the fact that data encryption between the server and client may still be available.
- Brand damage: While not exactly monetary, brand reputation damage can often be irreparable. Repeated disruptions, security warnings, and internet delays can turn away even devoted clients. When enterprise-grade customers are involved, this effect is multiplied, dramatically raising the possibility of losing a sizable portion of customers all at once. A decline in public trust can be extrapolated to a decline in confidence in the service as a whole, which has a number of negative consequences, including but not limited to declining stock values, losing shareholder support, and difficulty in securing funding.
- Opportunity and revenue losses: Loss of revenue is obvious if your users become hesitant to complete transactions and are scared off. Users are compelled to stop communicating with the affected website after a screen displays alarming notifications about expired certificates. Even if visitors ignore the browser warnings, they won’t be willing to reveal their credit card details or other sensitive information on your website because of the risk of breach and data theft.
Automated Certificate Lifecycle Management (CLM) Is a MUST!
When you factor in PCs, servers, mobile, networking, and IoT devices as well as applications, cloud services, containers and more, machine identities greatly outnumber human identities. Managing the ever-growing and dynamic inventory of certificates with legacy processes is not only complicated but impractical. This is why organizations must automate certificate management.
The 2023 CISO’s Guide to Certificate Lifecycle Management (CLM)
The longer it takes to identify an expired certificate, the more detrimental the outage can be to an organization. Having complete visibility into certificates across numerous cloud infrastructures, DevOps environments, and IoT is crucial. Certificate-related disruptions are unacceptable for organizations offering critical infrastructure services, like Starlink. Given the complexity of certificate sprawl and renewal deadlines, automating certificate lifecycle management (discovery, inventory, provisioning, renewals, revocation, and policy enforcement) is essential to eliminating outages and security concerns. And, with Google’s intention to shorten certificate validity and promote the usage of short-lived certificates, such results would only worsen if organizations do not employ automation to become crypto-agile.
The core underlying principle for certificate lifecycle management automation is to provide enterprises with complete visibility and control of their certificate and encryption infrastructure. This is achieved by centralizing management and automating certificate lifecycle processes end-to-end. In other words, automating certificate lifecycle management makes the process easy to manage, efficient, and secure.
Enrollment, deployment, renewals, and revocations are crucial tenets of certificate lifecycle management. It is important to ensure that certificate operations are diligently executed without errors, interruptions, or delays. Automation tools simplify the execution of these activities by providing a single, central interface for all certificate operations. Centralized management not only accelerates the process but eliminates the complexity of using siloed processes such as individual Certificate Authority (CA) interfaces to renew or revoke the certificates they’ve issued. It also helps streamline policy creation and enforcement across devices, workloads, and environments.
How AppViewX CERT+ Can Help?
AppViewX CERT+ is a ready-to-consume, scalable certificate lifecycle management (CLM) solution that automates all certificate processes end-to-end. You can discover, inventory, monitor, and automate the complete certificate lifecycle, all through a centralized console. By providing visibility, control, and insights, AppViewX CERT+ simplifies certificate lifecycle management and helps you stay on top of expiring certificates and security weaknesses.
AppViewX CERT+ monitors and presents the real-time statuses of certificates on dashboards and sends you alerts when a certificate nears expiry. Before a certificate expires, AppViewX CERT+ can automatically renew or request a new certificate from the CA of choice, download it, and bind it to the endpoint, saving time, and resources and preventing errors or expensive outages. It also runs compliance checks against set policies and criteria and performs automated rollbacks in case of non-compliance.
Talk to an expert today or register for a live demo to know how AppViewX CERT+, the next-gen machine identity management (MIM) platform, ensures a shift from reactive to proactive mode to eliminate outages and prevent data breaches.
About the Author
Debarati Biswas
Senior Specialist- Product Marketing
A content creator and a lifelong learner with an ongoing curiosity. She pens insightful resources to address the pain points of the readers and prospective buyers and help them make well-informed decisions.
