ibuy.co.za - Expired SSL cert

[morkhans]

I wanted to purchase some electricity this evening only to discovery that their SSL cert expired early this morning.

Looks like FNB is going to get my electricity business from now on...

 

[morkhans]

Their support team has acknowledged the problem. They are aware of it. :wtf:

Last time someone at my office needed certs they generated them online in minutes, not sure why it takes these guys more than a day (besides the fact that no one was tracking the expiry date).

 

[Swa]

I wouldn't trust someone that can just generate certificates. It's supposed to be a whole lengthy process of checks to make sure everything is legit. An expired certificate isn't the end of the world. If it was revoked though it's another matter.

 

[morkhans]

I wouldn't trust someone that can just generate certificates. It's supposed to be a whole lengthy process of checks to make sure everything is legit. An expired certificate isn't the end of the world. If it was revoked though it's another matter.

Let me clarify. Trusted certs, generated from a legitimate site. Take this as an example: http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=82356

 

[Gnome]

I wouldn't trust someone that can just generate certificates. It's supposed to be a whole lengthy process of checks to make sure everything is legit.

Nope.

An expired certificate isn't the end of the world.

Really? Would you do business with a company that forgot to pay their electricity bill?

It is sloppy to say the least.

 

[Swa]

Really? Would you do business with a company that forgot to pay their electricity bill?

It is sloppy to say the least.

Yes I would. I'd be hesitant to give them credit but paying for a product would have no bearing on that. Oversights do happen though so think about it logically here. Company A has been using a valid certificate for 1 year and 11 months. Company B has been using an expired certificate for 1 year and 1 day. Why is A more secure than B? They have had less time for their certificate to leak so should be more secure. Also what has changed between yesterday and today?

So you are basing a security matter on impression here and while it may be argued that they don't have good business practices there's no guarantee of that from a valid certificate.

 

[morkhans]

Got mail back from their support. Cert updated.

 

[shogun]

To be fair, the cert expired at 2am yesterday, and they probably needed a day to get their stuff in order, make payment, and update the cert on the server (we don't know who does their development).

Slack for not catching it beforehand, but stuff like this does happen. Doubt it's a reason for huge concern. A bunch of factors can creep in here (email used to sign up for cert may not have been monitored any more etc).

mountains... molehills

 

[Swa]

The irony. After reading this got to a site with one that expired months ago. They sell certificates!