3 ms·
> The only way to solve this problem is short key signature lifetimes, automated signatures and, if compromised, just no re-signature. I wonder if Let's Encryp
by philsnow 10y ago
> The only way to solve this problem is short key signature lifetimes, automated signatures and, if compromised, just no re-signature.
I wonder if Let's Encrypt is thinking ahead to a federated future where instead of issuing leaf certs, they also issue intermediate certs to domain owners, who can use those to mint very short-term leaf certificates (like 1-4h) in an automated fashion.
- Natanael_L 10y agoThat would strictly require that all TLS clients correctly handled intermediate certs with a scope limitated to a few hardcoded second level domains. Right now there's barely support for limiting a root CA to a single TLD...