3 ms·
Why is this an improvement? Has there been a rash of stolen certificates or domain name ownership changes? Is having a third party with a cert for a domain yo
by nullc 7y ago
Why is this an improvement? Has there been a rash of stolen certificates or domain name ownership changes? Is having a third party with a cert for a domain you're using for 12 months acceptable in a way that 2 years isn't?
It would be nicer if certs could be issued with long lives but required a stapled revalidation with a short time span (daily? weekly?), which would be automatically issued at any time requested unless the certificate was revoked.
- hamandcheese 7y agoHow does that help vs simply having short lived certificates?
- nullc 7y ago(re-)Validation costs. In theory, if it was just a "not revoked" signature, anyone could obtain it. No access to thorny private keys needed, etc.
- moviuro 7y ago> It would be nicer if certs could be issued with long lives but required a stapled revalidation with a short time span (daily? weekly?), which would be automatically issued at any time requested unless the certificate was revoked. That's called OCSP Must-Staple: see https://en.wikipedia.org/wiki/OCSP_stapling https://en.wikipedia.org/wiki/OCSP_stapling, https://github.com/acmesh-official/acme.sh/blob/d437d6fde95dc7368d4fa76c05648a8dd4cbe69e/acme.sh#L6270 https://github.com/acmesh-official/acme.sh/blob/d437d6fde95d..., https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#35-use-ocsp-stapling https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deploym...
- devrand 7y agoIt reduces risk since revocation is broken. Therefore the potential time that a compromised or misissued cert can be used is reduced by a year.