<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">I’m not certain it’s related, but we began noticing anomalies a couple days ago on most Microsoft websites (Microsoft.com, MSDN, Technet, etc.) when trying to view them through
our Sophos web security (proxy) appliance. Many elements fail to load causing the sites to look like garbage. When I try to download one of these elements from the Sophos appliance itself, I see the following certificate error:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">WARNING: cannot verify i-msdn.sec.s-msft.com's certificate, issued by `/C=NL/L=Amsterdam/O=Verizon Enterprise Solutions/OU=Cybertrust/CN=Verizon Akamai SureServer CA G14-SHA1':<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Unable to locally verify the issuer's authority.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">I can’t reproduce this error when loading the sites directly. Only through the Sophos appliance.<o:p></o:p></span></p>
<p>Christopher Thompson<br>
IT INFRASTRUCTURE MANAGER<br>
(952)906-7491<br>
westwoodps.com<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial","sans-serif""> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Outages [mailto:outages-bounces@outages.org]
<b>On Behalf Of </b>Jim Witherell via Outages<br>
<b>Sent:</b> Thursday, October 1, 2015 7:10 AM<br>
<b>To:</b> outages@outages.org<br>
<b>Subject:</b> Re: [outages] Akamai Cert Issues today<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<p class="MsoNormal">Aside from finding ways to make it fail, my point is that casual users are complaining to the help desk about it. We can duplicate it externally at home and on mobile devices. <o:p></o:p></p>
<div id="yMail_cursorElementTracker_0.023909340845420957">
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="yMail_cursorElementTracker_0.023909340845420957">
<p class="MsoNormal">Away from the debate about Akamai's issue that has evidently been out there awhile:<o:p></o:p></p>
</div>
<div id="yMail_cursorElementTracker_0.023909340845420957">
<p class="MsoNormal">-We're wondering what happened yesterday to break all these disparate websites <o:p></o:p></p>
</div>
<div id="yMail_cursorElementTracker_0.023909340845420957">
<p class="MsoNormal">-We're wondering if anyone else is seeing the problem or are receiving unusually high volume of complaints about getting to certaincertain and unrelated https sites in the last 18 or so hours. <o:p></o:p></p>
</div>
<div id="yMail_cursorElementTracker_0.023909340845420957">
<p class="MsoNormal"><o:p> </o:p></p>
<p><a href="https://overview.mail.yahoo.com/mobile/?.src=Android">Sent from Yahoo Mail on Android</a><o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in 0in 0in 0in">
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-family:"Arial","sans-serif";color:#7E7D80">From</span></b><span style="font-family:"Arial","sans-serif";color:#7E7D80">:"Jay Ashworth via Outages" <<a href="mailto:outages@outages.org">outages@outages.org</a>><br>
<b>Date</b>:Wed, Sep 30, 2015 at 11:21 PM<br>
<b>Subject</b>:Re: [outages] Akamai Cert Issues today<o:p></o:p></span></p>
</div>
<div id="msgSandbox_AO12w0MAAAKxVgymygcIyI8KQdo_TEXT">
<p class="MsoNormal">----- Original Message -----<br>
> From: "Sean Donelan via Outages" <<a href="javascript:return">outages@outages.org</a>><br>
<br>
> This is how Akamai has handled non-SSL customers for the last 15 years.<br>
> It is the same error message, and the same action. You just noticed<br>
> it.<br>
> <br>
> If you use https for a non-SSL customer on Akamai, you will connect to<br>
> a Akamai server using a "default" SSL certificate for all customers on<br>
> port 443.<br>
> <br>
> If you use https for a SSL customer on Akamai, you connect to different<br>
> IP addresses listening for specific customers which return a customer<br>
> specific SSL certificate.<br>
<br>
Doesn't that interact rather badly with HTTPS-Anywhere?<br>
<br>
Or, more to the point, would it not already have done so to date, rather<br>
loudly?<br>
<br>
Cheers,<br>
-- jra<br>
-- <br>
Jay R. Ashworth Baylink <a href="javascript:return">
jra@baylink.com</a><br>
Designer The Things I Think RFC 2100<br>
Ashworth & Associates <a href="http://www.bcp38.info%20" target="_blank">http://www.bcp38.info
</a> 2000 Land Rover DII<br>
St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274<o:p></o:p></p>
<div id="yqtfd38490">
<p class="MsoNormal"><br>
_______________________________________________<br>
Outages mailing list<br>
<a href="javascript:return">Outages@outages.org</a><br>
<a href="https://puck.nether.net/mailman/listinfo/outages" target="_blank">https://puck.nether.net/mailman/listinfo/outages</a><o:p></o:p></p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:gray">Confidentiality Statement:
</span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:gray">This message and any attachments may contain confidential, proprietary or legally privileged information. Any unauthorized dissemination, use, or disclosure of this information, either in whole
or in part, is strictly prohibited. The contents of this e-mail are for the intended recipient and are not meant to be relied upon by anyone else. If you have received this message in error, please advise the sender by reply e-mail, and delete this message
and any attachments. Thank you.</span></p>
</body>
</html>