In this post I will tell you a short story on how you can make over 10.000+ clients unhappy. In a web application or a client/server application you need to use secure connection and of course certificates. The application contains a backend that is pretty complicated and more web applications. Additionally to this, there are also some native applications on iPhone, iPad, Android and Windows Phone.
They are in production for about 5 years. In this period of time the web application changed, they started to create different native applications for mobile devices. Each native application contains also some certificates used to authenticate users and establish secure connection.
Everything was great until they decided to update their root certificate used by native applications. Guess what happened? All their mobile applications were down, none of their clients could use the mobile application anymore.
Because they’ve updated the servers’ certificates, all their clients that had “hardcoded” the client certificates were down. All the certificates made from that application were refused by servers.
The solution for their problem was to push a new update for mobile applications. Of course updating a mobile application requires 1, 2 days - to reach to the clients. In all this period of time they had a lot of complains.
What they’ve done wrong? Two things.
Hardcoding the client certificates into the mobile application and change the server certificates without taking into account all the dependencies.
They had to learn it in the hard-way, like other big companies.
0 comments:
Post a Comment