5 ms·
This might be a stupid question, but... Why do root certificates have to expire at all? The article presents this as if it's an immutable law of physics.
by grishka 6y ago
This might be a stupid question, but... Why do root certificates have to expire at all? The article presents this as if it's an immutable law of physics.
- MaxBarraclough 6y agoWe have no real means of revoking certificates whose private keys have leaked. Eventual expiration seems better than nothing. Also, ciphers tend to become obsolete, so enforcing churn will help keep things moving forward. I'm not an expert here though, there may be other reasons.
- radnom 6y ago> Eventual expiration seems better than nothing. Does it? Because that is the cause of the 'impending doom' from TFA
- grishka 6y agoI feel like if a certificate gets compromised, the fact that it expires in 5 years won't be of any help from the security standpoint. There are already mechanisms in place to revoke certificates before they expire. https://en.wikipedia.org/wiki/Certificate_revocation_list https://en.wikipedia.org/wiki/Certificate_revocation_list https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...