3 ms·
Why? The date says “Not valid after”, and the site operator can monitor it, or just set a calendar invite when it’s issued. Making the “real” expiration some ar
by akerl_ 5y ago
Why? The date says “Not valid after”, and the site operator can monitor it, or just set a calendar invite when it’s issued. Making the “real” expiration some arbitrary number of days after the marked expiration date seems like it’s unlikely to modify cert owner behaviors, but it does make validation way more complicated for browsers.
- selcuka 5y agoI agree, but it is also overkill to display a warning page saying that "you are in danger" just because the certificate expired today. There should be a middle ground.
- akerl_ 5y agoWhy? There’s already a clear better option: teams that run HTTPS sites need to monitor for cert expiry. It’s the easiest outage to avoid because the moment the cert is generated, you know the exact time it will expire.
- selcuka 5y agoYes,it's a better option for the site admins. It doesn't help the consumer though. Imagine you can't use your banking site because the certificate expired a few minutes ago and the browser displays a (unnecessarily dramatic) error message. Not everyone is tech savvy enough to ignore those messages. The browsers already let you visit the site if you want to, so I don't think there is a big deal.
- zaarn 5y agoThe user shouldn't trust a bank that let their cert expire, easy enough. For a bank, an expired cert is a nightmare in multiple departments.