upspin.io and key.upspin.io: certificate expired

[paulhankin]

Visiting https://upspin.io right now in chrome shows a Privacy Error screen.

It looks like the certificate for upspin.io expired yesterday. Today is 2017-04-16.

[paulhankin]

Maybe the cause is this: #365

[paulhankin]

Looks like the frontend cert has been renewed, but the certs for key.upspin.io are still invalid. Kris Foster mentioned it on the upspin group here: https://groups.google.com/forum/#!topic/upspin/uE_T7yulgPk

Here's a stacktrace when I try to run upspinfs on my local machine (with my personal information redacted):

2017/04/17 12:56:29.200429 dir/dircache.watcher: xxx@xxx.com: dir/remote.Watch("remote,upspin.xxx.xxx:443"): I/O error:
rpc.Invoke: 401 Unauthorized: rpc.SessionForRequest: I/O error:
user xxx@xxx.com:
rpc.PublicUserKeyService:
key/usercache.Lookup:
key/remote.Lookup("remote,key.upspin.io:443"):
rpc.InvokeUnauthenticated:
rpc.InvokeUnauthenticated: Post https://key.upspin.io:443/api/Key/Lookup: x509: certificate has expired or is not yet valid

[paulhankin]

Seems to be fixed.

[n2vi]

Not for me. We're looking into it, but a number of people are out of town. Sorry for the delay.

[presotto]

The current keyserver was deployed after Kris' change to deal with an x/crypto/acme/autocert change. It sees the cert that's there but isn't trying to refresh it. If I can figure out how, I'll revert to an older binary.

[transitorykris]

There's a couple additional changes related to the Context package in acme/autocert since the original breaking change. It's not immediately obvious if they're related to this issue. I'll take a closer look this afternoon.

golang/crypto@9b9c1af

[presotto]

Fixed for now by forcing a refresh by removing the old cert. We're still looking for the actual cause for the autocert code not causing a refresh.

[robpike]

This is being tracked in the Go issue tracker:

golang/go#20035
golang/go#17740

[adg]

Should we close this issue? It's not something that we can fix in this project.

[robpike]

I'd like to know when we don't have to worry about expiration. Keeping this open reminds me that we still do. I'd prefer to keep it open.

[robpike]

Both upstream issues are closed, so closing this.
Builds will need to sync with the udpated x/crypto/acme repository.