Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F-Droid site certificate expired

gitlab.com

Post reply on HN
Print view View original

11–20 of 115 posts

Re: F-Droid site certificate expired

#11

Post by kxxt »

crazygringo wrote: post #8
shaky-carrousel wrote: post #5

Earlier quoted context omitted.

It is, if your objective is to closely centralize the web. If you make https mandatory, via scare tactics, only people with certificates will have websites. If you make ephemeral certificates mandatory by taking advantage of a monopoly, then only big SSL providers who can afford it will survive. Then, when you have only two or three big SSL providers, it's way easier to shut someone off by denying them a certificate,…

You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint…

It's because CRLs/OCSP sucks so now short expiration is rolling out.

Re: F-Droid site certificate expired

#12

Post by [deleted] »

shaky-carrousel wrote: post #5
gethly wrote: post #3

Because those ephemeral LE certificates are such a great idea...

It is, if your objective is to closely centralize the web. If you make https mandatory, via scare tactics, only people with certificates will have websites. If you make ephemeral certificates mandatory by taking advantage of a monopoly, then only big SSL providers who can afford it will survive. Then, when you have only two or three big SSL providers, it's way easier to shut someone off by denying them a certificate,…

[deleted]

Re: F-Droid site certificate expired

#16

Post by m-p-3 »

crazygringo wrote: post #8
shaky-carrousel wrote: post #5

Earlier quoted context omitted.

It is, if your objective is to closely centralize the web. If you make https mandatory, via scare tactics, only people with certificates will have websites. If you make ephemeral certificates mandatory by taking advantage of a monopoly, then only big SSL providers who can afford it will survive. Then, when you have only two or three big SSL providers, it's way easier to shut someone off by denying them a certificate,…

You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint…

CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's an outage and the request can't be made instead of a hard fail and making the website inaccessible, reducing the security and usefulness of OCSP.

Short-lived certificates fixes these issues from an end-user standpoint.

Re: F-Droid site certificate expired

#17

Post by ozim »

m-p-3 wrote: post #16
crazygringo wrote: post #8

Earlier quoted context omitted.

You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint…

CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's an outage and the request can't be made instead of a hard fail and making the website inaccessible, reducing the security and usefulness of OCSP. Short-lived certificates fixes these issues from an end-user standpoint.

There are new solutions for CRL just last month:

https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...

Re: F-Droid site certificate expired

#18

Post by ozim »

kxxt wrote: post #11
crazygringo wrote: post #8

Earlier quoted context omitted.

You don't need short expirations for that. CRLs/OCSP already provided a mechanism for certificates to be revoked before they expire. However, short expirations severely limit the damage an attacker can do if they steal your private key. And they avoid the situations where an organization simply forgets to renew a cert, because automating something so infrequent is genuinely difficult from an organizational standpoint…

It's because CRLs/OCSP sucks so now short expiration is rolling out.

CRL doesn’t suck it is just not easy problem on web scale.

But seems like there is feasible solution: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...

Re: F-Droid site certificate expired

#20

Post by aaomidi »

ozim wrote: post #17
m-p-3 wrote: post #16

Earlier quoted context omitted.

CRLs are becoming bulky, and OCSP have some privacy implications (telling the CA which websites you visit), plus most browsers are set to soft fail if there's an outage and the request can't be made instead of a hard fail and making the website inaccessible, reducing the security and usefulness of OCSP. Short-lived certificates fixes these issues from an end-user standpoint.

There are new solutions for CRL just last month: https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co...

This has existed for a while. It doesn’t address another major issue with revocation: user agents that aren’t browsers don’t implement it.
Post reply on HN