Microsoft Exchange admin portal taken offline due to expired certificate

This isn't the first time an expired SSL/TLS cert has downed a service

Microsoft's Exchange administration portal was offline over the weekend after the company failed to renew an expired SSL/TLS certificate.

Bleeping Computer reported that Exchange administrators were unable to access the site on Sunday morning. They encountered an error page explaining that their connection was not private. At the time, Qualys Labs reported the certificate associated with the site expired at 8 am Eastern Time on Sunday, but Microsoft has since fixed the problem.

Twitter user Tzatl tweeted at the company on Sunday, asking: "Did you guys really forget to renew a certificate?" Microsoft responded that it had isolated the problem and was applying a fix, referring users to entry EX257883 under its service health dashboard.

The issue provoked some teasing from users on Twitter. "Someone done goofed," replied one user, along with a picture of the untrusted certificate report from Digicert Cloud Services.

This isn't the first time a large technology company has downed a service by forgetting to renew a certificate. 

Last month, Epic Games accidentally allowed a certificate used across many of its internal-facing services to expire. That took account logins offline for many of its most popular games, including Fortnite.

Related Resource

Enabling operational resiliency with Veritas

Boost your DX goals with data and infrastructure insights

A cityscape background against the water - Enabling operational resilience with VeritasWatch now

In February, Google Voice went offline temporarily after a certificate went out of date. In November, GitHub's home page went down after a certificate responsible for accessing information from a content distribution network expired. Last August, Spotify let a TLS certificate lapse, leaving users without music.

Secure Socket Layer (SSL) has evolved into its successor, Transport Layer Security (TLS). Both are cryptographic protocols that provide secure connections between two endpoints. An SSL/TLS certificate enables a website to prove its identity with a trusted third-party certificate authority (CA).

Certificate management is likely to become more problematic following a change to certificate longevity last September. Apple, Google, and Mozilla all imposed a maximum 398-day lifetime on certificates from September 1, 2020 in a bid to limit the time a site can use a compromised certificate. This continues a trend of shortening certificate lifespans, which stood at 60 months in 2012, 39 months in 2015, and 27 months in 2018. 

In its 2021 State of Machine Identity Management Report, Keyfactor found that 88% of companies had experienced at least one unplanned certificate outage in the prior two years.

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Recommended

How to get help in Windows 10
operating systems

How to get help in Windows 10

18 Jun 2021
Microsoft reveals plans for massive cloud expansion in China
data centres

Microsoft reveals plans for massive cloud expansion in China

18 Jun 2021
Microsoft's Nadella now holds dual role of CEO and chairman
Careers & training

Microsoft's Nadella now holds dual role of CEO and chairman

17 Jun 2021
Windows 11 leaks in full after early build shows up online
Microsoft Windows

Windows 11 leaks in full after early build shows up online

16 Jun 2021

Most Popular

Best paying tech jobs of 2021
Careers & training

Best paying tech jobs of 2021

7 Jun 2021
Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021
Mythic launches power-sipping AI chip
Hardware

Mythic launches power-sipping AI chip

8 Jun 2021