The February 29th Certificate — Java Bug Hunt

Briefing

Inspired by Azure's 2012 leap-day outage: certificates minted on February 29th were given a validity of "same date next year" — a date that does not exist. Cert creation failed, and the failure cascaded into a global outage.

CertIssuer.java adds one year to an issue date. Naively.

Bug report

BUG-0229-AZ · Priority: Critical · Reported by: platform security

expiryDate(year, month, day) = issue date + 1 year:

• Feb 29 -> Feb 28 of the next year (clamp; next year is never leap+1)
• all other dates keep month/day

Observed: [2012, 2, 29] -> [2013, 2, 29], which downstream validation rejects, which takes cert issuance down entirely.

Logs

[pki] mint 2012-02-29 -> expiry 2013-02-29 INVALID DATE
[pki] issuance pipeline halted

The code as shipped

CertIssuer.java (editable)

class CertIssuer {
    static boolean isLeap(int year) {
        return year % 4 == 0 && (year % 100 != 0 || year % 400 == 0);
    }

    static int[] expiryDate(int year, int month, int day) {
        return new int[] { year + 1, month, day };
    }
}