3 ms·
The reason to expiration dates on certificates is so that a compromised private key has a limited lifetime of applicability, under an assumption that you will b
by saurik 7y ago
The reason to expiration dates on certificates is so that a compromised private key has a limited lifetime of applicability, under an assumption that you will be actively rotating keys and issuing new certificates that expire at later points in time. As far as I would think this consideration has nothing at all to do with whether the certificate is self-signed.
- phicoh 7y agoThe model in most software that allows self-signed certs is that you eiter disable checking all together, or that the user accepts a specific cert. If you disable checking all together, then an attacker doesn't need to compromise a private key. Any impersonation attack will just work. If you require the user to accept a specific cert (and store that information) then you can just as well let the user accept an expired cert. The current situation just creates a lot of hassle for people without any security benefit. Key rotation is completely separate from the lifetime of a cert. You can renew certs while keeping keys constant forever. In practice, if your key gets compromised and you have to wait for the cert to expire, then you have a very big problem. Even with letsencrypt it is likely more than a month before the cert expires.
- AnIdiotOnTheNet 7y ago> The current situation just creates a lot of hassle for people without any security benefit. In my experience, many "security" people see this as the purpose of their job.
- mrspuratic 7y agoAlso keeps CRLs as short as possible.