Chromium and Mozilla to enforce 1 year validity for TLS certificates
chromium.googlesource.com
Chromium and Mozilla to enforce 1 year validity for TLS certificates
1–10 of 375 posts
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#2Why exactly 398 days? Seems a little bit odd as it’s approx 13 months plus additional 2-3 days.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#3I’m so torn here. Personally I like this a lot and think it will really help enforce good practices and allow easier things like root/int key rotation. Professionally it sucks, as there are a ton of valid use cases for real certs in areas that require manual work and tracking them all is a hard problem. If internal PKIs were easier to make work across all OS and Browser combos I’d just use those instead.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#4This CCADB vote provides the context missing from this link to a Chromium patch. After the CA issuers rejected 2017 and 2019 proposals (Ballot 185, Ballot SC22) to reduce certificate issuance times to ~1 year, Apple announced enforcement of the rejected 398-days limit across all platforms on 01 Sep 2020, the CAs reversed their position while complaining that they were being forced to, and Chromium is now implementing the policy as well.
https://cabforum.org/2017/02/24/ballot-185-limiting-lifetime...
https://archive.cabforum.org/pipermail/servercert-wg/2019-Se...
https://ccadb-public.secure.force.com/mozillacommunications/...
> SUB ITEM 3.1: Limit TLS Certificates to 398-day validity Last year there was a CA/Browser Forum ballot to set a 398-day maximum validity for TLS certificates. Mozilla voted in favor, but the ballot failed due to a lack of support from CAs. Since then, Apple announced they plan to require that TLS certificates issued on or after September 1, 2020 must not have a validity period greater than 398 days, treating certificates longer than that as a Root Policy violation as well as technically enforcing that they are not accepted. We would like to take your CA’s current situation into account regarding the earliest date when your CA will be able to implement changes to limit new TLS certificates to a maximum 398-day validity period.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#5This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated.
It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time.
Without automation, you've got an annual chore to do or your site goes offline.
I think some hosts are already starting to offer free and easy SSL certs to their small customers, but I do expect automated SSL management to be generally available for the masses before this takes effect.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#6Why exactly 398 days? Seems a little bit odd as it’s approx 13 months plus additional 2-3 days.
I am just guessing but I think it's because of renewals. I know in the past when I've purchased a certificate before the expiration date, the CA gives me that extra time on the new cert so the expiration date stays the same the following year.
Totally speculating here that 30 days is probably the earliest one can renew a yearly cert.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#7I’m so torn here. Personally I like this a lot and think it will really help enforce good practices and allow easier things like root/int key rotation. Professionally it sucks, as there are a ton of valid use cases for real certs in areas that require manual work and tracking them all is a hard problem. If internal PKIs were easier to make work across all OS and Browser combos I’d just use those instead.
TOFU is a viable alternative for "long-living" certs, too. The very fact that the cert has longer validity makes it somewhat easier to trust it directly in the client.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#8Why exactly 398 days? Seems a little bit odd as it’s approx 13 months plus additional 2-3 days.
12 mths plus 30 days to pay maybe?
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#9This is Google and Mozilla aligning with Apple's earlier announcement (https://support.apple.com/en-us/HT211025).
The CABF has talked about doing this before, most recently in SC22 (https://cabforum.org/2019/09/10/ballot-sc22-reduce-certifica...). In that case all browsers supported it, but it wasn't passed by the CA side.
Re: Chromium and Mozilla to enforce 1 year validity for TLS certificates
#10This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL…
Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?