1311471 - RCA 2016-10-19 SSL Certificate for people

Status: RESOLVED FIXED

(Infrastructure & Operations :: MOC: Root Cause Analysis, task)

Description

[Salvador Espinoza [:sal]]

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1310484

Please complete the following form to the best of your ability for RCA 
https://docs.google.com/document/d/1dc2LiuHWPs5MLBF3tHbgK5FvIytxqafio9nks-9v8S0/edit

Comment 1

[Peter Radcliffe [:pir]]

:atoll are there any actions to take to try and prevent this kind of problem happening in the future?

Comment 2

[:Atoll]

(In reply to Salvador Espinoza [:sal] from comment #0)
> Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1310484
> 
> Please complete the following form to the best of your ability for RCA 
> https://docs.google.com/document/d/1dc2LiuHWPs5MLBF3tHbgK5FvIytxqafio9nks-
> 9v8S0/edit

I've completed this form, but I think the form is months out of date, and is missing key fields that other RCA forms contain.

(In reply to Peter Radcliffe [:pir] from comment #1)
> :atoll are there any actions to take to try and prevent this kind of problem
> happening in the future?

Yes.

1) We're patching the scripts on ssl1.private.phx1 to explicitly inform users when a private key is generated, so that they understand that no existing key was found.

2) We documented how to verify the modulus of the private key and the signed certificate, and trained the team on why it's important to do so.

Other steps are being taken to simplify the SSL process, but those steps are not applicable to this particular incident.

Comment 3

[Peter Radcliffe [:pir]]

Thanks :atoll, I think there's enough here. Are there bugs for those followup actions we could link to this bug?

Comment 4

[:Atoll]

Bug 1319236.