[deleted]
Chromium and Mozilla to enforce 1 year validity for TLS certificates
11–20 of 375 posts
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#12To clarify, this is the limit for how long they can be to be considered valid.
Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do).
Let's Encrypt certificates are only valid three months, which works well because it's largely automated. It would be good to extend that philosophy elsewhere: automation, and with shorter cycles.
Note the actual limit is 398 days, which gives a small buffer over 1 year.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#13I'd quite like to see this eventually getting to more like 1 month, maybe 7 days - forcing continuous automated issuance.
Ideally, something more like 1 hour - like a JWT - would be nice, but not particularly practical as you need to allow some margin for incorrect local clocks time
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#14> Enforce publicly trusted TLS server certificates have a
lifetime of 398 days or less, if they are issued on or after
2020-09-01.
Fortunately not enforced for currently issued certs.
Will this ever be part of the TLS spec?
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#15Why exactly 398 days? Seems a little bit odd as it’s approx 13 months plus additional 2-3 days.
> The choice of 397 days represents the maximum legitimate interpretation of a "thirteen-month" period; it's calculated from 366 days (considering leap years) along with a 31-day month, the longest in the calendar used by certificates. And the “Must Not Exceed 398 days” also accommodate the different time zones and any other unexpected error.
https://sslretail.com/news/ssl-validity-limiting-to-one-year...
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#16This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…
Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?
Shared hosting
Unless they set up LtE for their customers
(And as much as I like LtE I think it's complicate to depend in one issuer only)
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#17This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…
> that still takes some time to set up, manage and maintain over time.
I’d say it takes less time than going through a single paid certificate store… Assuming you already have a tool. If you don’t, then maybe it’s the same or 5 minutes more.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#18Earlier quoted context omitted.
Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?
Shared hosting Unless they set up LtE for their customers (And as much as I like LtE I think it's complicate to depend in one issuer only)
Semaphor asks "can you describe the kind of person". Since when is "shared hosting" a person?
People who know how to set up a website on a shared hosting platform probably also know how to renew a LE certificate, I think.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#19From the source code:
https://chromium.googlesource.com/chromium/src/+/ae4d6809912...
// For certificates issued on-or-after the BR effective date of 1 July 2012:
// 60 months.
// For certificates issued on-or-after 1 April 2015: 39 months.
// For certificates issued on-or-after 1 March 2018: 825 days.
// For certificates issued on-or-after 1 September 2020: 398 days.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#20Internet starts to have 1y memory retention.
Unless refreshed by active learning, aka someone doing the refresh job.
Or unless delegating the work to large players—either the memory or the hosting.
EDIT: This feels wrong, even when done for right reasons. And I wonder whether this would fly without LE and whether this means we are officially making LE THE critical part of Internet infrastructure.