really?

Samasulee · September 2014

https:/ / queue.elderscrollsonline.com/?c=zenimaxonline&e=live&t=https%3A%2F%2Faccount.elderscrollsonline.com%2F%3F_ga%3D1.39856229.654855694.1409759006

Your connection is not private

Attackers might be trying to steal your information from queue.elderscrollsonline.com (for example, passwords, messages or credit cards).

So does this mean you guys are going to give me a free month cause it seems I can not access my account?? I very much doubt it

Aett_Thorn · September 2014

The link that you provided is an untrusted connection, and you should probably remove the link. This seems more like a customer service issue, and should probably be taken up directly with them.

nerevarine1138 · September 2014

I'm actually going to guess this is a Chrome issue (assuming you're using Chrome), because this is the second "https" site that's given me that message today.

Circuitous · September 2014

You attempted to reach queue.elderscrollsonline.com, but the server presented an expired certificate. No information is available to indicate whether that certificate has been compromised since its expiration. This means Google Chrome cannot guarantee that you are communicating with queue.elderscrollsonline.com and not an attacker. Your computer's clock is currently set to Friday, September 5, 2014 9:27:19 AM. Does that look right? If not, you should correct the error and refresh this page.

ZOS didn't update their security certificates and this is how Chrome chooses to alert you.

It's probably not a genuine concern, and you can tell Chrome to ease up and let you through by clicking "Advanced" and then the link that says to proceed at the bottom.

You're absolutely right to bring this to ZOS's attention, however. This shouldn't be happening, and it's not Chrome's fault.

Samasulee · September 2014

thanks you guys, I stopped and looked at the address a bit better and seen the extra "S" in the Http and I don't really know if it supposed to be there....
I cut the link up a bit so it won't connect to anything, just leave it here for reference.

ZOS_GinaBruno · September 2014

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

nerevarine1138 · September 2014

Samasulee wrote: »

thanks you guys, I stopped and looked at the address a bit better and seen the extra "S" in the Http and I don't really know if it supposed to be there....
I cut the link up a bit so it won't connect to anything, just leave it here for reference.

No, it's a legit link. The extra "s" stands for "secure," so if Chrome detects that the certificate is out of date, it gives you that warning. I did a quick check on the site, and it does look like the certificate expired yesterday. So it was just random chance that I saw two of these today.

Circuitous · September 2014

Samasulee wrote: »

thanks you guys, I stopped and looked at the address a bit better and seen the extra "S" in the Http and I don't really know if it supposed to be there....
I cut the link up a bit so it won't connect to anything, just leave it here for reference.

https:// means it's using a secure protocol, which has to verify a certificate to determine the authenticity of the connection. If it can't verify that certificate (like in this instance where it's expired), then it alerts you and does not consider the connection secure.

Without that security, the connection can hypothetically be hijacked, redirected, or snooped upon. That doesn't mean that's actually happening, necessarily, just that it's possible.

rsciw · September 2014

ZOS_GinaBruno wrote: »

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

What, are you saying your ops guys don't have any monitoring system for SSL Cert expiry dates?

Samasulee · September 2014

@nerevarine1138 , @Circuitous thanks for the info, I like learning new things

Circuitous · September 2014

rsciw wrote: »

ZOS_GinaBruno wrote: »

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

What, are you saying your ops guys don't have any monitoring system for SSL Cert expiry dates?

I wouldn't be shocked if they do have it, but the people doing the actual monitoring don't have the ability to make the necessary changes, instead leaving it up to a good bit of bureaucracy. It's a bit ridiculous, but I can't say that ZOS doesn't seem mismanaged enough to pull it off.

nerevarine1138 · September 2014

Circuitous wrote: »

rsciw wrote: »

ZOS_GinaBruno wrote: »

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

What, are you saying your ops guys don't have any monitoring system for SSL Cert expiry dates?

I wouldn't be shocked if they do have it, but the people doing the actual monitoring don't have the ability to make the necessary changes, instead leaving it up to a good bit of bureaucracy. It's a bit ridiculous, but I can't say that ZOS doesn't seem mismanaged enough to pull it off.

It's already been fixed, so speculating on it is kind of pointless.

Circuitous · September 2014

nerevarine1138 wrote: »

Circuitous wrote: »

rsciw wrote: »

ZOS_GinaBruno wrote: »

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

What, are you saying your ops guys don't have any monitoring system for SSL Cert expiry dates?

I wouldn't be shocked if they do have it, but the people doing the actual monitoring don't have the ability to make the necessary changes, instead leaving it up to a good bit of bureaucracy. It's a bit ridiculous, but I can't say that ZOS doesn't seem mismanaged enough to pull it off.

It's already been fixed, so speculating on it is kind of pointless.

I'll agree that speculating is pointless, but that link still clearly shows a certificate error on my end.

nerevarine1138 · September 2014

Circuitous wrote: »

nerevarine1138 wrote: »

Circuitous wrote: »

rsciw wrote: »

ZOS_GinaBruno wrote: »

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

What, are you saying your ops guys don't have any monitoring system for SSL Cert expiry dates?

I wouldn't be shocked if they do have it, but the people doing the actual monitoring don't have the ability to make the necessary changes, instead leaving it up to a good bit of bureaucracy. It's a bit ridiculous, but I can't say that ZOS doesn't seem mismanaged enough to pull it off.

It's already been fixed, so speculating on it is kind of pointless.

I'll agree that speculating is pointless, but that link still clearly shows a certificate error on my end.

I'm clicking on the "Account" link on the site right now, and it's no longer creating an error for me. And checking the SSL info, it does seem that there was some kind of coding issue, because this one is valid as of June this year. The invalid link was valid as of September last year.

Edit: but copying/pasting the OP's link doesn't work still, so I'm betting that's just a time-sensitive thing. The actual account access link is working again.

Circuitous · September 2014

nerevarine1138 wrote: »

Circuitous wrote: »

nerevarine1138 wrote: »

Circuitous wrote: »

rsciw wrote: »

ZOS_GinaBruno wrote: »

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

What, are you saying your ops guys don't have any monitoring system for SSL Cert expiry dates?

I wouldn't be shocked if they do have it, but the people doing the actual monitoring don't have the ability to make the necessary changes, instead leaving it up to a good bit of bureaucracy. It's a bit ridiculous, but I can't say that ZOS doesn't seem mismanaged enough to pull it off.

It's already been fixed, so speculating on it is kind of pointless.

I'll agree that speculating is pointless, but that link still clearly shows a certificate error on my end.

I'm clicking on the "Account" link on the site right now, and it's no longer creating an error for me. And checking the SSL info, it does seem that there was some kind of coding issue, because this one is valid as of June this year. The invalid link was valid as of September last year.

Edit: but copying/pasting the OP's link doesn't work still, so I'm betting that's just a time-sensitive thing. The actual account access link is working again.

The certificate issue was on queue.elderscrollsonline.com, not account.elderscrollsonline.com.

The queue subdomain is a queuing service for excess customer loads, and its security certificate was (and still is) expired. Attempting to access the account page under heavy load will redirect you there, and voila, bad certificates.

So it's not a time-sensitive thing, you're just looking at the wrong page.

ZOS_GinaBruno · September 2014

Just a quick update, we've disabled the queue service for now while we get the renewed cert applied. Thanks again for the reports, guys.

starkerealm · September 2014

Circuitous wrote: »

nerevarine1138 wrote: »

Circuitous wrote: »

nerevarine1138 wrote: »

Circuitous wrote: »

rsciw wrote: »

ZOS_GinaBruno wrote: »

Hey guys, just letting you know that we're actively looking at this now. Note that it's still safe to access your account page. Thanks for the heads up!

What, are you saying your ops guys don't have any monitoring system for SSL Cert expiry dates?

I wouldn't be shocked if they do have it, but the people doing the actual monitoring don't have the ability to make the necessary changes, instead leaving it up to a good bit of bureaucracy. It's a bit ridiculous, but I can't say that ZOS doesn't seem mismanaged enough to pull it off.

It's already been fixed, so speculating on it is kind of pointless.

I'll agree that speculating is pointless, but that link still clearly shows a certificate error on my end.

I'm clicking on the "Account" link on the site right now, and it's no longer creating an error for me. And checking the SSL info, it does seem that there was some kind of coding issue, because this one is valid as of June this year. The invalid link was valid as of September last year.

Edit: but copying/pasting the OP's link doesn't work still, so I'm betting that's just a time-sensitive thing. The actual account access link is working again.

The certificate issue was on queue.elderscrollsonline.com, not account.elderscrollsonline.com.

The queue subdomain is a queuing service for excess customer loads, and its security certificate was (and still is) expired. Attempting to access the account page under heavy load will redirect you there, and voila, bad certificates.

So it's not a time-sensitive thing, you're just looking at the wrong page.

If I had to guess, the queue sub was probably set up to handle overflow at launch, and was never really intended to see long term use. But, nobody ever actually turned it off, so here we are.