3 ms·
I'd quite like to see this eventually getting to more like 1 month, maybe 7 days - forcing continuous automated issuance. Ideally, something more like 1 hour -
by BillinghamJ 6y ago
I'd quite like to see this eventually getting to more like 1 month, maybe 7 days - forcing continuous automated issuance.
Ideally, something more like 1 hour - like a JWT - would be nice, but not particularly practical as you need to allow some margin for incorrect local clocks time
- daneel_w 6y agoHow would 1 hour be ideal? Have you considered the immense increase of logistic costs and power consumption this would incur?
- patmorgan23 6y agoOk I'm in favor of shorter cert times but one hour is ridiculous. If you need a key pair for that amount of time generate an ephemeral one! The cert can be valid for months and still be secure.
- tgsovlerkhgsel 6y agoOCSP stapling may be what you're looking for. The certificate stays the same, but an additional short-lived signature indicating that it wasn't revoked yet is attached. Aside from not spamming the CT log and possibly making it easier to offload the generation of the OCSP responses to a more efficient architecture than the one needed to issue certificates, I'm not sure how mandatory OCSP stapling is better than just reissuing the certificate every day/week.