3 ms·

The 7-day expiration was definitely something we (Sandstorm) asked for, not Globalsign. It does simplify recovery after a Heartbleed-like bug, as described in

by kentonv 11y ago

The 7-day expiration was definitely something we (Sandstorm) asked for, not Globalsign. It does simplify recovery after a Heartbleed-like bug, as described in the blog post. Of course it doesn't prevent the bug from happening, but it does greatly simplify recovery afterwards, which is important to me. The security properties are in fact the most exciting thing about short-lived certificates for me personally. For the sake of transparency, there is another motivation: For a 1-week certificate, we pay 1/52 of what we would have for a 1-year certificate. So if a user installs Sandstorm, gets a certificate, and immediately uninstalls, we don't pay for a full year. More importantly, if a user installs sandstorm several times -- perhaps due to a bug or a misunderstanding -- and gets a new cert every time, we don't take a huge hit. Basically, we get some risk management out of this deal.

abritishguy 11y ago
It would be nice if you included the financial motivation in the article as well. Makes total sense, and I totally agree that 7 day certs are better (security wise) than 1 year, I just wasn't sure that in the absence of any financial motivation whether it would be worth the effort (having to roll private keys every week) for the limited protection it gives you.
- savant 11y ago
  You eventually have to roll over keys at least once every N years, so if you are automating it, the length of time doesn't really matter. In this case, they are just limiting the window.
  - kentonv 11y ago
    Indeed, we were going to do the auto-renewal regardless, so making it every 7 days didn't really add any work. Meanwhile I really am paranoid about long-lived keys of any sort, especially if they need to be online as TLS keys must. I wish CAs offered short-lived keys more readily (and web infrastructure supported it); I'd love to enable them for all Sandstorm properties.

by kentonv 11y ago

abritishguy 11y ago

It would be nice if you included the financial motivation in the article as well. Makes total sense, and I totally agree that 7 day certs are better (security wise) than 1 year, I just wasn't sure that in the absence of any financial motivation whether it would be worth the effort (having to roll private keys every week) for the limited protection it gives you.

savant 11y ago
You eventually have to roll over keys at least once every N years, so if you are automating it, the length of time doesn't really matter. In this case, they are just limiting the window.
- kentonv 11y ago
  Indeed, we were going to do the auto-renewal regardless, so making it every 7 days didn't really add any work. Meanwhile I really am paranoid about long-lived keys of any sort, especially if they need to be online as TLS keys must. I wish CAs offered short-lived keys more readily (and web infrastructure supported it); I'd love to enable them for all Sandstorm properties.