Obviously they were working as fast as they possibly could without risking major outages. They probably had millions of servers to update.
I'd even argue that it's not a good idea to advertise, "these servers are vulnerable to this attack".
AWS is massive and organizing that kind of update by an army of engineers isn't easy.
You received a non-personalized message because AWS support probably received tens of thousands of irate customers demanding that their systems be patched immediately. For some reason they weren't equipped to handle that kind of update but I'm sure they will learn from this and hopefully next time the response will be faster, if possible.
TFA gives you a clue why you need to know when all ELBs are updated:
* "However, due to nobody outside of AWS knowing exactly how ELB works, this could just mean that the machines currently responding to the requests are patched, but in the next request, it could hit an unpatched ELB machine."
* "We then wrote to support to hear if it was now safe to re-key the certificates, but did not hear from them for hours."
Summary: You re-key your certificates, thinking you are all good. Now an attacker hits a non-patched ELB, exploits the issue and gets your new keys.
So you pay for revocation of certificates twice. The first time you revoked the certicates, someone could have compromised them immediately afterwards. How is that a good solutions?
Is payment for revocation standard practice? I've reissued and revoked probably a dozen Comodo certs (both directly and via Namecheap as a reseller) without issue.
Comments
Obviously they were working as fast as they possibly could without risking major outages. They probably had millions of servers to update.
I'd even argue that it's not a good idea to advertise, "these servers are vulnerable to this attack".
AWS is massive and organizing that kind of update by an army of engineers isn't easy.
You received a non-personalized message because AWS support probably received tens of thousands of irate customers demanding that their systems be patched immediately. For some reason they weren't equipped to handle that kind of update but I'm sure they will learn from this and hopefully next time the response will be faster, if possible.
TFA gives you a clue why you need to know when all ELBs are updated:
* "However, due to nobody outside of AWS knowing exactly how ELB works, this could just mean that the machines currently responding to the requests are patched, but in the next request, it could hit an unpatched ELB machine."
* "We then wrote to support to hear if it was now safe to re-key the certificates, but did not hear from them for hours."
Summary: You re-key your certificates, thinking you are all good. Now an attacker hits a non-patched ELB, exploits the issue and gets your new keys.
So wait until you see this message: https://aws.amazon.com/security/security-bulletins/heartblee...
and then update your certs again just to be safe.
So you pay for revocation of certificates twice. The first time you revoked the certicates, someone could have compromised them immediately afterwards. How is that a good solutions?
There's not always a perfect solution, gotta work with what you're given.
If you absolutely can't wait for the updated status message then the solution I gave was the only solution.
If the price of the revocation (which my issuer doesn't charge) is too high for your business then your only option is to wait.
Is payment for revocation standard practice? I've reissued and revoked probably a dozen Comodo certs (both directly and via Namecheap as a reseller) without issue.
I suppose it matters to know when the patch has been completed, so that new keys can be generated as quickly as possible.
The overall tone of the post seems rather out of proportions though.