Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

21–30 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#21

Post by joobus »

SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

> it reduces their potential for abuse.

It will also increase the number of errors. The more times a thing is done increases the total number of errors occurring doing that thing.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#22

Post by daneel_w »

BillinghamJ wrote: post #13

I'd quite like to see this eventually getting to more like 1 month, maybe 7 days - forcing continuous automated issuance. Ideally, something more like 1 hour - like a JWT - would be nice, but not particularly practical as you need to allow some margin for incorrect local clocks time

How would 1 hour be ideal? Have you considered the immense increase of logistic costs and power consumption this would incur?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#23

Post by floatingatoll »

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

One reason for these proposals was to put pressure on the SSL certificate ecosystem to provide (CAs) and adopt (hosting) automated SSL renewal practices. Businesses have had three years since Let's Encrypt first went live to adopt such practices, but many chose not to — not just hosting providers, but e.g. bigcorp load balancers too.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#24

Post by slim »

SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

which makes websites ephemeral and at the mercy of a few authorities. my torrent website could disappear within a few months behind a scary "this site is dangerous" notice

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#26

Post by phantom784 »

mrgalaxy wrote: post #6
tomklein wrote: post #2

Why exactly 398 days? Seems a little bit odd as it’s approx 13 months plus additional 2-3 days.

I am just guessing but I think it's because of renewals. I know in the past when I've purchased a certificate before the expiration date, the CA gives me that extra time on the new cert so the expiration date stays the same the following year. Totally speculating here that 30 days is probably the earliest one can renew a yearly cert.

366 (days in a leap year) + 31 (longest month) = 397. So it's exactly one more than that.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#29

Post by jwilk »

floatingatoll wrote: post #15
tomklein wrote: post #2

Why exactly 398 days? Seems a little bit odd as it’s approx 13 months plus additional 2-3 days.

> The choice of 397 days represents the maximum legitimate interpretation of a "thirteen-month" period; it's calculated from 366 days (considering leap years) along with a 31-day month, the longest in the calendar used by certificates. And the “Must Not Exceed 398 days” also accommodate the different time zones and any other unexpected error. https://sslretail.com/news/ssl-validity-limiting-to-one-year...

Why 13 months though?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#30

Post by ceejayoz »

joobus wrote: post #21
SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

> it reduces their potential for abuse. It will also increase the number of errors. The more times a thing is done increases the total number of errors occurring doing that thing.

A world-class chef may have nicked their fingers more times than I have with a knife, but I suspect their food is still better than mine.
Post reply on HN