Chromium and Mozilla to enforce 1 year validity for TLS certificates

Post by floatingatoll » Sun, Jun 28, 2020, 7:20 PM UTC

paranoidrobot wrote: post #169

floatingatoll wrote: post #40

Earlier quoted context omitted.

A less labor-intensive approach would be require CAs to revalidate the 'proof of ownership' basis of issued certificates monthly, and publish a revocation via CRL if the validation times out or fails for 1 month + 1 day. This would further encourage automation of the ecosystem without requiring redeployment in the cases where automated verification passes each month.

Less labour intensive for whom? Anyone using email validation now needs to click a link every month, or their cert goes away. I used to have the unfortunate task of managing a massive SAN cert used for white-label hosting with a bunch of our customer's domains. Getting every single customer to get their tech person to look at the mailbox and click a link was often a multi-month process.

Post by tgsovlerkhgsel » Sun, Jun 28, 2020, 7:24 PM UTC

BillinghamJ wrote: post #13

I'd quite like to see this eventually getting to more like 1 month, maybe 7 days - forcing continuous automated issuance. Ideally, something more like 1 hour - like a JWT - would be nice, but not particularly practical as you need to allow some margin for incorrect local clocks time

Post by Someone » Sun, Jun 28, 2020, 7:35 PM UTC

greatgib wrote: post #136

Remember the good old time when it was not an almighty cartel of browsers that controlled your internet? This is so an arbitrary decision and so much a pain in the ass. Again, a limited number of people used their corporate interests to decide for the whole world with almost no discussion. The worst is that the "security" argument for this change is quite weak. Yes, we can think that shorter certificates are a little…

Post by j1elo » Sun, Jun 28, 2020, 7:44 PM UTC

superkuh wrote: post #244

j1elo wrote: post #180

Earlier quoted context omitted.

> How is HTTP harmful when you visit my website about amateur radio? "Unharmful" HTTP sites are used to silently hack people's computers and keep them under observation for months. Every unsecured site contributes their small piece to keep the web unsafe for people who needs it to be safe. https://www.amnesty.org/en/latest/research/2020/06/moroccan-...

This is exactly the same as blaming getting shot at a neighbor's BBQ on the neighbor for not hiring private security to deal with the government army specifically attacking you. If your threat model includes nation state attacks you're gonna have problems no matter what. Change your personal behavior accordingly. Don't tell everyone else they need to wear bullet proof vests around the house and hire corporate securit…

Post by dingaling » Sun, Jun 28, 2020, 7:52 PM UTC

polishdude20 wrote: post #41

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Check out Caddy Server. It was only a few days ago when I was still managing my own certs and renewing them with a Cron job. Caddy now acts as my proxy for my various web domains and it handles certs automatically. Like literally you fill out a few lines in the config called a Caddy file and you do Caddy run and it gets the certs itself. And as long as it's running, it renews them automatically.