3 ms·

Cert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.

by xxpor 11y ago

ars 11y ago
I got downmodded before for saying this, but I still feel this way: Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. I don't consider this a positive thing. You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way. I have yet to hear any useful reason to rotate the key.
- profmonocle 11y ago
  Hasn't this always been true for domain validated certificates? If you control the domain's content, you can get a cert. I don't see how LE makes that any worse.
- thesimon 11y ago
  >Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case. >I have yet to hear any useful reason to rotate the key. http://security.stackexchange.com/questions/85963/what-is-the-purpose-of-frequently-rotating-tls-certificates-without-changing-und http://security.stackexchange.com/questions/85963/what-is-th... Basically limiting damage in case of a compromise.
  - Laforet 11y ago
    A short validity period also helps to keep the size of revocation lists manageable as they expire sooner.
- imaginenore 11y ago
  If they hack your machine, they can generate new certificates whether you have LetsEncrypt installed or not. They can just install it.
- rakoo 11y ago
  It's like not-perfect-but-still-good forward secrecy: Your old certificate may be leaked or decrypted, but it will only endanger past communications; the communications after this one will still be secure. Another side-effect is that you don't need to manage revocation stuff as diligently, because certificates automatically expire shortly. The window during which a certificate is valid is extremely short and recent, which means there is less chance that a problem happens. when that probability increases (as a result of being older), certificates become automatically invalid.
- marcosdumay 11y ago
  Well, they can generate new certificates for as long as they have access to your machine. Take that access away, and they can't generate certificates anymore. All in, the Lets Encrypt way brings you more security. Since the certificate validity is shorter, even generating an extra certificate will give the attacker a smaller average time with a valid cert than stealing your StartSSL cert.

Cert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.

by xxpor 11y ago

Cert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.

ars 11y ago

I got downmodded before for saying this, but I still feel this way: Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. I don't consider this a positive thing. You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way. I have yet to hear any useful reason to rotate the key.

profmonocle 11y ago
Hasn't this always been true for domain validated certificates? If you control the domain's content, you can get a cert. I don't see how LE makes that any worse.
thesimon 11y ago
>Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case. >I have yet to hear any useful reason to rotate the key. http://security.stackexchange.com/questions/85963/what-is-the-purpose-of-frequently-rotating-tls-certificates-without-changing-und http://security.stackexchange.com/questions/85963/what-is-th... Basically limiting damage in case of a compromise.
- Laforet 11y ago
  A short validity period also helps to keep the size of revocation lists manageable as they expire sooner.
imaginenore 11y ago
If they hack your machine, they can generate new certificates whether you have LetsEncrypt installed or not. They can just install it.
rakoo 11y ago
It's like not-perfect-but-still-good forward secrecy: Your old certificate may be leaked or decrypted, but it will only endanger past communications; the communications after this one will still be secure. Another side-effect is that you don't need to manage revocation stuff as diligently, because certificates automatically expire shortly. The window during which a certificate is valid is extremely short and recent, which means there is less chance that a problem happens. when that probability increases (as a result of being older), certificates become automatically invalid.
marcosdumay 11y ago
Well, they can generate new certificates for as long as they have access to your machine. Take that access away, and they can't generate certificates anymore. All in, the Lets Encrypt way brings you more security. Since the certificate validity is shorter, even generating an extra certificate will give the attacker a smaller average time with a valid cert than stealing your StartSSL cert.