3 ms·

Maybe there should be a "warned from" extension for certificates, which contains a date within the validity period from which on user agents are supposed to dis

by est31 5y ago

Maybe there should be a "warned from" extension for certificates, which contains a date within the validity period from which on user agents are supposed to display warnings?

selcuka 5y ago
I believe the "Not Valid After" field should be used as a "Warn for x days after this date" value where x is a small value (such as 3).
- akerl_ 5y ago
  Why? The date says “Not valid after”, and the site operator can monitor it, or just set a calendar invite when it’s issued. Making the “real” expiration some arbitrary number of days after the marked expiration date seems like it’s unlikely to modify cert owner behaviors, but it does make validation way more complicated for browsers.
  - selcuka 5y ago
    I agree, but it is also overkill to display a warning page saying that "you are in danger" just because the certificate expired today. There should be a middle ground.
    - akerl_ 5y ago
      Why? There’s already a clear better option: teams that run HTTPS sites need to monitor for cert expiry. It’s the easiest outage to avoid because the moment the cert is generated, you know the exact time it will expire.
      - selcuka 5y ago
        Yes,it's a better option for the site admins. It doesn't help the consumer though. Imagine you can't use your banking site because the certificate expired a few minutes ago and the browser displays a (unnecessarily dramatic) error message. Not everyone is tech savvy enough to ignore those messages. The browsers already let you visit the site if you want to, so I don't think there is a big deal.
        zaarn 5y ago
        The user shouldn't trust a bank that let their cert expire, easy enough. For a bank, an expired cert is a nightmare in multiple departments.
- est31 5y ago
  I think that would cause issues during various security reviews, because it would imply that the browser is accepting expired certificates, even if there is a warning. Also, CAs might not revoke expired certificates any more, as they are already expired, which hurts security as well if there is a reason to revoke the certificate, but no means to do so. With an extension, this feature can be introduced gently, without risking any security issues.

by est31 5y ago

Maybe there should be a "warned from" extension for certificates, which contains a date within the validity period from which on user agents are supposed to display warnings?

selcuka 5y ago

I believe the "Not Valid After" field should be used as a "Warn for x days after this date" value where x is a small value (such as 3).

akerl_ 5y ago
Why? The date says “Not valid after”, and the site operator can monitor it, or just set a calendar invite when it’s issued. Making the “real” expiration some arbitrary number of days after the marked expiration date seems like it’s unlikely to modify cert owner behaviors, but it does make validation way more complicated for browsers.
- selcuka 5y ago
  I agree, but it is also overkill to display a warning page saying that "you are in danger" just because the certificate expired today. There should be a middle ground.
  - akerl_ 5y ago
    Why? There’s already a clear better option: teams that run HTTPS sites need to monitor for cert expiry. It’s the easiest outage to avoid because the moment the cert is generated, you know the exact time it will expire.
    - selcuka 5y ago
      Yes,it's a better option for the site admins. It doesn't help the consumer though. Imagine you can't use your banking site because the certificate expired a few minutes ago and the browser displays a (unnecessarily dramatic) error message. Not everyone is tech savvy enough to ignore those messages. The browsers already let you visit the site if you want to, so I don't think there is a big deal.
      - zaarn 5y ago
        The user shouldn't trust a bank that let their cert expire, easy enough. For a bank, an expired cert is a nightmare in multiple departments.
est31 5y ago
I think that would cause issues during various security reviews, because it would imply that the browser is accepting expired certificates, even if there is a warning. Also, CAs might not revoke expired certificates any more, as they are already expired, which hurts security as well if there is a reason to revoke the certificate, but no means to do so. With an extension, this feature can be introduced gently, without risking any security issues.