4 ms·
> people must renew every year or 13 months that just so happens to collect tons of rent seeking income from a few firms Isn’t it primarily free CAs like LE th
by NobodyNada 6y ago
> people must renew every year or 13 months that just so happens to collect tons of rent seeking income from a few firms
Isn’t it primarily free CAs like LE that are pushing for shorter expiration times?
IIRC the primary argument is not about security or safety, but rather that shorter certificate lifetimes encourage companies to automate certificate renewal/make it a regular part of their business routine. If you only have to renew a certificate every five years, then it’s really easy to forget.
- prepend 6y agoI think it’s just as easy to automate a monthly renewal as a five year renewal. The argument that gets presented to me is that shorter times reduce the risk of someone compromising the cert and pretending to be the real server. But that risk requires a pretty motivated attacker to also compromise DNS or server farm and that probably doesn’t matter because they will plan around any renewal cycle.
- jasonpeacock 6y agoWhen you tell management "we need to automate this process that won't happen for 5 years", you're not going to get approval. When you tell management "we need to automate this process that will happen every month", you will get approval. It's not about the effort to automate the process, it's the opportunity cost of investing that effort.