ARO Security

Nicholas Schmidt at
Mon May 18 16:30:04 UTC 2015

I cant find a way to reach out to whoever manages ARO directly so I figure
it would be best to publish this to the list.

We are a group of network operators who are failing at enforcing extremely
basic security in our own applications.

1.) Retrieving an ARO password sends a plain text email of your current
password. Im sure this is minor as its just ARO and none of us would ever
re-use a password in more critical systems.

2.) The SSL cert for is invalid. It looks to be
trying to use the wildcard for

$ openssl s_client -showcerts -connect


depth=0 /OU=Domain Control Validated/CN=*

verify error:num=20:unable to get local issuer certificate

verify return:1

depth=0 /OU=Domain Control Validated/CN=*

verify error:num=27:certificate not trusted

verify return:1

depth=0 /OU=Domain Control Validated/CN=*

verify error:num=21:unable to verify the first certificate

verify return:1


Certificate chain

 0 s:/OU=Domain Control Validated/CN=*

   i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./OU= Secure Certificate
Authority - G2

More information about the NANOG mailing list