2 ms·

> Sorry, what's your source? https://en.wikipedia.org/wiki/Transport_Layer_Security#Algorithm https://en.wikipedia.org/wiki/Transport_Layer_Security#Algor...

> Sorry, what's your source? https://en.wikipedia.org/wiki/Transport_Layer_Security#Algorithm https://en.wikipedia.org/wiki/Transport_Layer_Security#Algor... Yes, the Let's Encrypt certificates are valid for only 90 days. > whose keys 1) are distributed to all major browsers and/or operating systems Not exactly. Root certificates are widely distributed to user-agent applications but the actual website certificates are available upon request from visiting the sites. A CA is an issuing authority for certificates. Certificates are not directly a component of encryption, but serve to validate the encryption is trusted. * https://en.wikipedia.org/wiki/Root_certificate https://en.wikipedia.org/wiki/Root_certificate * https://en.wikipedia.org/wiki/Certificate_authority https://en.wikipedia.org/wiki/Certificate_authority * https://en.wikipedia.org/wiki/Public_key_certificate https://en.wikipedia.org/wiki/Public_key_certificate * certificate distribution schemes - https://www.ics.uci.edu/~keldefra/teaching/fall2016/uci_compsci134/slides/LEC12-KED.pdf https://www.ics.uci.edu/~keldefra/teaching/fall2016/uci_comp...

dredmorbius 7y ago
Again, there's nothing in the Wikipedia link which specifies that site certificates MUST exist for a specific duration. Because there's no such requirement in RFC 8446 4.4.2.2, "Server Certificate Selection": https://tools.ietf.org/html/rfc8446#section-4.4.2.2 https://tools.ietf.org/html/rfc8446#section-4.4.2.2 If you have information otherwise please do us both the favour of quoting the relevant language from an authoritative source directly in your reply. You're also creating a dispute based on a claim I've not made. CA keys being "distributed to all major browsers and/or operating systems", my claim, which you quote, does not preclude other distribution mechanisms. That discussion is unnecessary here. Your understanding, generally, seems in error. Again: TLS sever keys have no minimum duration requirement, as the Let's Encrypt description previously cited makes explicitly clear: "renewal can take place at any time".
- austincheney 7y ago
  > Again, there's nothing in the Wikipedia link which specifies that site certificates MUST exist for a specific duration. I never said anything like that. Web certificates are around for as long as both the website and CA are willing to service them.
  - dredmorbius 7y ago
    "Websites require long term certificate retention and every year or two those certificates are replaced just like email PKI keys are" https://news.ycombinator.com/item?id=22893385 https://news.ycombinator.com/item?id=22893385
    - austincheney 7y ago
      CAs generally issue certificates to websites for 1 or 2 years, but there isn't a fixed duration imposed by cryptography standards. Sometimes the certificates are rejected prematurely due to compromise, and there is a process for that called key revocation. I am thinking you reading something more into what I wrote than the words on the screen.
      - dredmorbius 7y ago
        there isn't a fixed duration imposed by cryptography standards Which was my point in the first place. A distinct difference from the case of data-at-rest. I am thinking you reading something more into what I wrote than the words on the screen. I disagree, but suggest the same for yourself.

dredmorbius 7y ago

Again, there's nothing in the Wikipedia link which specifies that site certificates MUST exist for a specific duration. Because there's no such requirement in RFC 8446 4.4.2.2, "Server Certificate Selection": https://tools.ietf.org/html/rfc8446#section-4.4.2.2 https://tools.ietf.org/html/rfc8446#section-4.4.2.2 If you have information otherwise please do us both the favour of quoting the relevant language from an authoritative source directly in your reply. You're also creating a dispute based on a claim I've not made. CA keys being "distributed to all major browsers and/or operating systems", my claim, which you quote, does not preclude other distribution mechanisms. That discussion is unnecessary here. Your understanding, generally, seems in error. Again: TLS sever keys have no minimum duration requirement, as the Let's Encrypt description previously cited makes explicitly clear: "renewal can take place at any time".

austincheney 7y ago
> Again, there's nothing in the Wikipedia link which specifies that site certificates MUST exist for a specific duration. I never said anything like that. Web certificates are around for as long as both the website and CA are willing to service them.
- dredmorbius 7y ago
  "Websites require long term certificate retention and every year or two those certificates are replaced just like email PKI keys are" https://news.ycombinator.com/item?id=22893385 https://news.ycombinator.com/item?id=22893385
  - austincheney 7y ago
    CAs generally issue certificates to websites for 1 or 2 years, but there isn't a fixed duration imposed by cryptography standards. Sometimes the certificates are rejected prematurely due to compromise, and there is a process for that called key revocation. I am thinking you reading something more into what I wrote than the words on the screen.
    - dredmorbius 7y ago
      there isn't a fixed duration imposed by cryptography standards Which was my point in the first place. A distinct difference from the case of data-at-rest. I am thinking you reading something more into what I wrote than the words on the screen. I disagree, but suggest the same for yourself.