Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium and Mozilla to enforce 1 year validity for TLS certificates

chromium.googlesource.com

Post reply on HN
Print view View original

71–80 of 375 posts

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#71

Post by znpy »

SquareWheel wrote: post #12

To clarify, this is the limit for how long they can be to be considered valid. Certificates are encouraged to be of shorter lengths as it reduces their potential for abuse. If compromised, a certificate with a long lifespan could be used for years without anyone noticing. A system which doesn't check for revocation is especially vulnerable (though of course, browsers do). Let's Encrypt certificates are only valid thr…

> To clarify, this is the limit for how long they can be to be considered valid.

to be fair, there's already a the concept of certificate revocation list and OCSP (on-line certificate status protocol) that helps in order to check the validity of a certificate (that is, whether it has been revoked or not).

While short-lived certificates are fine for letsencrypt, pushing the same for the rest of the world looks a bit like an abuse to me.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#72

Post by demersb »

xg15 wrote: post #66
dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

Without buying a domain. (and continously spending money to keep it owned)

~$5/year (US) for a domain, and a one time investment of setting up a few scripts might save you a lot of time in the long run.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#73

Post by znpy »

csours wrote: post #14

> Enforce publicly trusted TLS server certificates have a lifetime of 398 days or less, if they are issued on or after 2020-09-01. Fortunately not enforced for currently issued certs. Will this ever be part of the TLS spec?

hopefully not. there is a huuuuge number of services that are not http based that use tls and certificates.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#74

Post by sschueller »

kspacewalk2 wrote: post #38
nieve wrote: post #32

It's a positive for security, but unless you're going through Let's Encrypt it adds another entity that you have to disclose PII to simply to host your own blog or side project.

What are some valid reasons not to use LetsEncrypt?

It's a single point of failure that has to follow US laws and sanctions.

If you only have one domain it isn't and issue as you can just go get a certificate somewhere else. But if you have 1000+ domains it's an issue.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#75

Post by mschuster91 »

cm2187 wrote: post #49
vageli wrote: post #44

Earlier quoted context omitted.

> I can see this policy being used for censorship in this age of cancel culture. Don't virtue signal hard enough for the latest outrage mob? No cert for you. How does that work with a largely automated process like Let's Encrypt?

A couple of lines of code to enforce domain black lists if the relevant activits apply enough pressure.

Why should anyone do this? It's way easier and more effective to put pressure on hosters, anti-DDOS services and the payment providers to get Nazis booted off the net, see e.g. Stormfront.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#76

Post by dimensi0nal »

xg15 wrote: post #66
dharmab wrote: post #65

Earlier quoted context omitted.

Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.

Without buying a domain. (and continously spending money to keep it owned)

A .net is 83 cents a month.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#77

Post by blibble »

markstos wrote: post #5

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…

it takes absolutely no time at all to set up for an individual on their VPS, compared to the faff of going through the openssl csr process + buying from a CA

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#78

Post by mschuster91 »

psim1 wrote: post #68

Help me understand why > 1 year server certs are problematic but issuers have 20 year roots. Isn’t the issuer’s cert a bigger concern?

It is, people got screwed with AddTrust in the last weeks en masse, and there is a boatload of root certs expiring in the next ten years.

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#79

Post by gpm »

waheoo wrote: post #53
floatingatoll wrote: post #40

Earlier quoted context omitted.

A less labor-intensive approach would be require CAs to revalidate the 'proof of ownership' basis of issued certificates monthly, and publish a revocation via CRL if the validation times out or fails for 1 month + 1 day. This would further encourage automation of the ecosystem without requiring redeployment in the cases where automated verification passes each month.

Misses the point. The concern is all historic traffic being vulnerable to a single encryption failure. Short cert lives make certain decloaking much, kuch more difficult.

It looks like 84% of sites [1] use forward security with modern browsers, which should mean historic traffic is not vulnerable to a leaked key.

It seems like driving this number up is a better way of dealing with historic traffic than quickly expiring certs. Limiting the duration of leaks of future traffic seems like the right justification for short lived certs.

[1] https://www.ssllabs.com/ssl-pulse/

Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates

#80

Post by sschueller »

mschuster91 wrote: post #70
lixtra wrote: post #59

Earlier quoted context omitted.

If Letsencrypt was the only CA left I would call it a big failure. Without a choice there cannot be trust.

LE is open standard, any CA can decide to implement it.

The only other CA I know that has this service available is https://www.buypass.com/ssl/products/acme
Post reply on HN