My SSL expiry checker was six weeks off on github.com
TL;DR: My SSL certificate expiry check said github.com was covered until 11 Jan 2027. The ECDSA certificate github.com was actually serving expires on 29 Nov 2026, about six weeks earlier, and it also serves an RSA certificate that expires on 30 Dec 2026. My tool reads Certificate Transparency logs, and the logic picked the newest certificate in the log, one that was issued but not being served.…
An SSL certificate expiry checker reported that the GitHub website (github.com) would be covered until January 11th, 2027. However, the actual expiration of the ECDSA certificate served by that domain is November 29th, 2026. Additionally, the same hostname also serves an RSA certificate with an expiration date of December 30th, 2026.
My tool, MyIPScan, utilizes Certificate Transparency (CT) logs to generate these reports, but in this case, it misread the expiration date. It focused on the newest certificate in the CT logs, which was not currently being served by GitHub. This oversight led to an inaccurate prediction that was six weeks off. To avoid this, MyIPScan should present the range of currently valid certificates and highlight the earliest expiration date, indicating that a newer certificate has been issued but not yet deployed.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
