Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

31–40 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#31

Post by staticassertion »

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#33

Post by SquareWheel »

joobus wrote: post #21
SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

> it reduces their potential for abuse. It will also increase the number of errors. The more times a thing is done increases the total number of errors occurring doing that thing.

You're right that more attempts means more chances at failure, but I don't think it's a 1-to-1 relationship. It's when I don't perform a task for a few years that I tend to make mistakes.

Even if it's not an automated process (which I think this encourages), then it's easier to keep your skills sharpened by doing something more often.

Would Mozilla have accidentally forgotten to renew their browser certificate recently if it were a more frequent task? It's hard to say, but I think it's likely there'd be a stronger procedure in place. There would need to be.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#34

Post by est31 »

jwilk wrote: post #29
floatingatoll wrote: post #15

Earlier quoted context omitted.

> The choice of 397 days represents the maximum legitimate interpretation of a "thirteen-month" period; it's calculated from 366 days (considering leap years) along with a 31-day month, the longest in the calendar used by certificates. And the “Must Not Exceed 398 days” also accommodate the different time zones and any other unexpected error. https://sslretail.com/news/ssl-validity-limiting-to-one-year...

Why 13 months though?

With 13 months, you can renew your certificate once per year and still have one month of buffer time. But in 2 or 3 years the maximum length might be tightened even further. At least there has been such a trend of length decreases in the past.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#35

Post by floatingatoll »

jwilk wrote: post #29
floatingatoll wrote: post #15

Earlier quoted context omitted.

> The choice of 397 days represents the maximum legitimate interpretation of a "thirteen-month" period; it's calculated from 366 days (considering leap years) along with a 31-day month, the longest in the calendar used by certificates. And the “Must Not Exceed 398 days” also accommodate the different time zones and any other unexpected error. https://sslretail.com/news/ssl-validity-limiting-to-one-year...

Why 13 months though?

Because it's 1 year + 1 month + 1 day.

1 year (366 days): See the ballots and accompanying discussion linked in other comments about the proposal to reduce validity to 1 year.

1 month (31 days): Grace period for human beings, to permit weekends, vacations, and continuity handoffs.

1 day (timezones): Grace period for browsers and shared libraries, to survive the timezone math issues with "It's one day greater than today somewhere in the world". This ends up baked into the process as follows: Certificates will be issued for "397 days or less", browsers and libraries will validate as "398 days or less".

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#36

Post by altfredd »

floatingatoll wrote: post #4

This CCADB vote provides the context missing from this link to a Chromium patch. After the CA issuers rejected 2017 and 2019 proposals (Ballot 185, Ballot SC22) to reduce certificate issuance times to ~1 year, Apple announced enforcement of the rejected 398-days limit across all platforms on 01 Sep 2020, the CAs reversed their position while complaining that they were being forced to, and Chromium is now implementing…

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#37

Post by maxmalysh »

wolf550e wrote: post #10
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

http://www.paulgraham.com/

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#38

Post by kspacewalk2 »

nieve wrote: post #32

It's a positive for security, but unless you're going through Let's Encrypt it adds another entity that you have to disclose PII to simply to host your own blog or side project.

What are some valid reasons not to use LetsEncrypt?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#39

Post by kspacewalk2 »

Almad wrote: post #20

Internet starts to have 1y memory retention. Unless refreshed by active learning, aka someone doing the refresh job. Or unless delegating the work to large players—either the memory or the hosting. EDIT: This feels wrong, even when done for right reasons. And I wonder whether this would fly without LE and whether this means we are officially making LE THE critical part of Internet infrastructure.

Websites marked "insecure" are still fully accessible.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#40

Post by floatingatoll »

altfredd wrote: post #36
floatingatoll wrote: post #4

This CCADB vote provides the context missing from this link to a Chromium patch. After the CA issuers rejected 2017 and 2019 proposals (Ballot 185, Ballot SC22) to reduce certificate issuance times to ~1 year, Apple announced enforcement of the rejected 398-days limit across all platforms on 01 Sep 2020, the CAs reversed their position while complaining that they were being forced to, and Chromium is now implementing…

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

A less labor-intensive approach would be require CAs to revalidate the 'proof of ownership' basis of issued certificates monthly, and publish a revocation via CRL if the validation times out or fails for 1 month + 1 day. This would further encourage automation of the ecosystem without requiring redeployment in the cases where automated verification passes each month.
Post reply on HN