4 ms·
This would require everyone to understand that previous certs still require high-security for at least a few weeks post expiration. This is not something we can
by lilyball 6y ago
This would require everyone to understand that previous certs still require high-security for at least a few weeks post expiration. This is not something we can rely on people understanding.
- im3w1l 6y agoAllowing bypass is the old way of doing things, and many non-browsers still allow it, so you should ideally hold on to old certs indefinitely, but at least for a short while.
- deleted 6y ago[deleted]
- darkerside 6y agoI think this is reasonable for people dealing with SSL, like expecting a mechanic to know you change an oil filter when you change the oil.
- zeroimpl 6y agoI'm pretty sure that most people, upon having one of their certs expire, do not find the private key and release it publicly. In fact they often generate a new cert from the same key...
- bendbro 6y agoAlternatively we could have people understand all certificates, regardless of expiration, are high security. Is there any reason someone would want to publicize an expired certificate? Additionally, I can think of a few existing reasons someone would avoid publicizing an expired certificate.