4 ms·
What I find bizarre is software that accepts a self-signed certificate only to then reject the cert because it has expired. What security problem are they tryin
by phicoh 7y ago
What I find bizarre is software that accepts a self-signed certificate only to then reject the cert because it has expired. What security problem are they trying to solve there?
- saurik 7y agoThe reason to expiration dates on certificates is so that a compromised private key has a limited lifetime of applicability, under an assumption that you will be actively rotating keys and issuing new certificates that expire at later points in time. As far as I would think this consideration has nothing at all to do with whether the certificate is self-signed.
- phicoh 7y agoThe model in most software that allows self-signed certs is that you eiter disable checking all together, or that the user accepts a specific cert. If you disable checking all together, then an attacker doesn't need to compromise a private key. Any impersonation attack will just work. If you require the user to accept a specific cert (and store that information) then you can just as well let the user accept an expired cert. The current situation just creates a lot of hassle for people without any security benefit. Key rotation is completely separate from the lifetime of a cert. You can renew certs while keeping keys constant forever. In practice, if your key gets compromised and you have to wait for the cert to expire, then you have a very big problem. Even with letsencrypt it is likely more than a month before the cert expires.
- AnIdiotOnTheNet 7y ago> The current situation just creates a lot of hassle for people without any security benefit. In my experience, many "security" people see this as the purpose of their job.
- mrspuratic 7y agoAlso keeps CRLs as short as possible.
- thdrdt 7y agoI think what Cisco is trying to solve is to give users the possibility to connect to the device over a secure connection in case a user has no access to a signed certificate by an authority. So the user must still connect the self-signed certificate when connecting to the device (over ssh for example). So in this case the user generates the certificate and also accepts it. By the way, most ssh clients will tell you if a certificate changed. So the moment your self-signed certificate is compromised you will know.
- oarsinsync 7y ago> most ssh clients will tell you if a certificate changed Most implementations of ssh in the wild don't use CA (or self) signed certificates. I dont know if Cisco even supports the use of ssh with certificates.
- GhettoMaestro 7y agoCisco SSH has supported public key auth for as far as I can recall.
- oarsinsync 7y agoSSH keys and certificates are different authentication mechanisms (I learnt this from https://news.ycombinator.com/item?id=20955465 https://news.ycombinator.com/item?id=20955465)
- jlgaddis 7y ago> I dont know if Cisco even supports the use of ssh with certificates. They do -- in addition to public key auth, as GhettoMaestro mentioned.
- C1sc0cat 7y agoI would assume you can login via the CON (console) or the AUX port as a last resort.
- 2ion 7y agoYou can build good PKI using your own private CA just as well as using any publicly trusted root. Esp. in the realm of on-prem infra, that's not uncommon.