Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

41–50 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#41

Post by polishdude20 »

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Check out Caddy Server. It was only a few days ago when I was still managing my own certs and renewing them with a Cron job. Caddy now acts as my proxy for my various web domains and it handles certs automatically. Like literally you fill out a few lines in the config called a Caddy file and you do Caddy run and it gets the certs itself. And as long as it's running, it renews them automatically.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#42

Post by kspacewalk2 »

slim wrote: post #24
SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

which makes websites ephemeral and at the mercy of a few authorities. my torrent website could disappear within a few months behind a scary "this site is dangerous" notice

It's just gonna be a red strike through the lock in Firefox.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#43

Post by Avamander »

altfredd wrote: post #36
floatingatoll wrote: post #4

This CCADB vote provides the context missing from this link to a Chromium patch. After the CA issuers rejected 2017 and 2019 proposals (Ballot 185, Ballot SC22) to reduce certificate issuance times to ~1 year, Apple announced enforcement of the rejected 398-days limit across all platforms on 01 Sep 2020, the CAs reversed their position while complaining that they were being forced to, and Chromium is now implementing…

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

CAs are resting all and every changes because it's easier, it makes sense.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#44

Post by vageli »

joobus wrote: post #25

I can see this policy being used for censorship in this age of cancel culture. Don't virtue signal hard enough for the latest outrage mob? No cert for you.

> I can see this policy being used for censorship in this age of cancel culture. Don't virtue signal hard enough for the latest outrage mob? No cert for you.

How does that work with a largely automated process like Let's Encrypt?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#45

Post by brnt »

altfredd wrote: post #36
floatingatoll wrote: post #4

This CCADB vote provides the context missing from this link to a Chromium patch. After the CA issuers rejected 2017 and 2019 proposals (Ballot 185, Ballot SC22) to reduce certificate issuance times to ~1 year, Apple announced enforcement of the rejected 398-days limit across all platforms on 01 Sep 2020, the CAs reversed their position while complaining that they were being forced to, and Chromium is now implementing…

Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.

Will browsers start allowing self signed certificates though?

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#46

Post by caymanjim »

slim wrote: post #24
SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

which makes websites ephemeral and at the mercy of a few authorities. my torrent website could disappear within a few months behind a scary "this site is dangerous" notice

Is your torrent website hosting illegal/pirated content? It's probably already dangerous.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#47

Post by cm2187 »

wolf550e wrote: post #10
markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

Devices with web based interface (KVM over IP, IPMI, etc).

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#48

Post by [deleted] »

reaperhulk wrote: post #9

This is Google and Mozilla aligning with Apple's earlier announcement ( https://support.apple.com/en-us/HT211025 ). The CABF has talked about doing this before, most recently in SC22 ( https://cabforum.org/2019/09/10/ballot-sc22-reduce-certifica... ). In that case all browsers supported it, but it wasn't passed by the CA side.

[deleted]

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#49

Post by cm2187 »

vageli wrote: post #44
joobus wrote: post #25

I can see this policy being used for censorship in this age of cancel culture. Don't virtue signal hard enough for the latest outrage mob? No cert for you.

> I can see this policy being used for censorship in this age of cancel culture. Don't virtue signal hard enough for the latest outrage mob? No cert for you. How does that work with a largely automated process like Let's Encrypt?

A couple of lines of code to enforce domain black lists if the relevant activits apply enough pressure.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#50

Post by reidacdc »

joobus wrote: post #21
SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

> it reduces their potential for abuse. It will also increase the number of errors. The more times a thing is done increases the total number of errors occurring doing that thing.

There's a countervailing effect where the more often you do something, the better you get at it.

You're right that the absolute number of errors will certainly rise, but the fraction of attempts which have errors will likely fall. As legacy certs expire, the aggregate quality of certs will likely be higher.

A secondary question is whether the gain in security is worth the required effort. Obviously Apple believes this, and LetsEncrypt is pretty easy, so even for hobbyists, it's probably at worst an annoyance.

Post reply on HN