Massive podcast outage caused by Spotify’s failure to renew security certificate

Podcast listeners could not access many of their favorite shows for more than eight hours on Monday night and early Tuesday morning due to an outage on Megaphone, a podcast hosting platform owned by Spotify. The outage stemmed from the company’s failure to renew Megaphone’s security certificate.

“Megaphone experienced a platform outage due to an issue related to our SSL certificate,” Spotify spokesperson Erin Styles said in a statement. “During the outage, clients were unable to access the Megaphone CMS and podcast listeners were unable to download podcast episodes from Megaphone-hosted publishers. Megaphone service has since been restored.”

It’s a simple mistake with big ramifications. Megaphone, which inserts dynamic ads into episodes, hosts many of the industry’s top shows. It also distributes shows on platforms beyond Spotify, including Apple Podcasts and Google Podcasts. Spotify hosts its own licensed and owned shows, like The Joe Rogan Experience and shows from The Ringer, on Megaphone. (Disclosure: Vox Media, owner of The Verge, also publishes podcasts on Megaphone). Styles said that the company is reaching out to affected publishers.

This is the second time in a week that JRE in particular has been affected by technical issues at Spotify. On Wednesday, dozens of episodes were removed from the show’s feed due to a glitch.

Spotify acquired Megaphone in December 2020 for $235 million, making it the streamer’s biggest purchase in its quest to build a comprehensive podcasting tech stack (for comparison, it paid about $150 million for Anchor). The tool allows the company to make money off of podcast listening that happens even on competitor platforms. Since then, Spotify has bulked up Megaphone by acquiring and integrating analytics tools Podsights and Chartable and radio-to-podcast tool Whooshkaa.

Spotify did not comment as to why Megaphone’s SSL certificate was left to expire and why it took so long to fix. The certificate expired at 8PM ET on Monday, according to data found by Podnews. The issue was not resolved for another eight hours, according to the platform’s status page. Even after Megaphone came back online just before 6AM ET, podcasters experienced delays with the Megaphone CMS. As of 9:45AM, the company said the issue was fully resolved.

The SSL certificate, which stands for Secure Sockets Layer, is a data encryption tool for websites (it is the “S” in HTTPS) that allows a server to communicate with a client (your computer or phone, for example), sending data that others can’t easily modify or spy on. While SSL certificates used to be good for as long as three years, starting in September 2020, SSL certificates were limited to a maximum of 13 months. However, Megaphone secured a two-year certificate in May 2020, seven months before it was acquired by Spotify.

The outage irked listeners and podcasters alike, who took to social media to warn others of the problem and request that Spotify fix it. Luke Braun, a podcaster who hosts Locked On Vikings and Locked On NFL, said that the outage could cost the shows thousands of downloads across platforms because the upload was delayed. Before the Megaphone issue was fixed, the only platform to which he could post Tuesday’s episodes was YouTube, which accounts for about 20 percent of his audience.

While Braun says he is overall satisfied with Megaphone, which he has used since 2018, he also wasn’t entirely shocked that the outage occurred over such a dumb mistake. “It seems like a brain fart,” he said.