This summary should emphasize that it's a 398 day _maximum_.
Chromium and Mozilla to enforce 1 year validity for TLS certificates
51–60 of 375 posts
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#52Does it also apply to certs issued by a private/own CA or just public certificates?
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#53Earlier quoted context omitted.
Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.
A less labor-intensive approach would be require CAs to revalidate the 'proof of ownership' basis of issued certificates monthly, and publish a revocation via CRL if the validation times out or fails for 1 month + 1 day. This would further encourage automation of the ecosystem without requiring redeployment in the cases where automated verification passes each month.
Misses the point. The concern is all historic traffic being vulnerable to a single encryption failure.
Short cert lives make certain decloaking much, kuch more difficult.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#54Earlier quoted context omitted.
Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.
Will browsers start allowing self signed certificates though?
No... web of trust is an important aspect to https.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#55Earlier quoted context omitted.
Sounds like CAs will be forced to keep shrinking cert length until everyone standardizes on 1 month. They no longer have any real power.
Will browsers start allowing self signed certificates though?
As long as you first create a root certificate then you can create how many certificates you want.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#56This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…
Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?
Letsencrypt is broken or an incredible pain in so many different setups its not even funny.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#57With the tightening of certificate trust, demise of self-signed certificates, etc., is there any remaining way to establish a consumer-oriented HTTPS server on a local network? Thinking of things like routers, printers, and self-hosted IoT devices here. Some of the label printers we support at work have simply atrocious workarounds to get them to work, and I'm wondering if it's the manufacturer's fault or if that use case has been completely abandoned in the push for tighter security on the Internet.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#58Does it also apply to certs issued by a private/own CA or just public certificates?
EDIT: Sorry, replied to the wrong comment!
---
cf. https://support.apple.com/en-us/HT211025:
> This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS.
> This change will not affect certificates issued from user-added or administrator-added Root CAs.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#59It's a positive for security, but unless you're going through Let's Encrypt it adds another entity that you have to disclose PII to simply to host your own blog or side project.
What are some valid reasons not to use LetsEncrypt?
If Letsencrypt was the only CA left I would call it a big failure. Without a choice there cannot be trust.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#60This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…
Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?
Me. I use shared hosting on a server that runs a reverse nginx proxy to my nginx server. I don't have root on the server. I have a LE cert that I need to manually fiddle with DNS settings every 3 months to get. If you know how to automate it I'd love to hear about it.