3 ms·
The old Let's encrypt root certificate (DST Root CA X3 [1]) was from 2001, was signed with sha1, and is 2048 bit RSA. What criteria would you use to decide exp
by notriddle 5y ago
The old Let's encrypt root certificate (DST Root CA X3 [1]) was from 2001, was signed with sha1, and is 2048 bit RSA.
What criteria would you use to decide expiration dates for 20 years in the future?
[1]: https://crt.sh/?id=8395 https://crt.sh/?id=8395
- anderskaseorg 5y agoTo be clear, the self-signature on a root certificate is meaningless (it only exists so that root certificates can be parsed with the same code as intermediate and leaf certificates); using SHA-1 there is not a risk. https://www.entrust.com/blog/2014/04/need-sha-2-signed-root-certificates/ https://www.entrust.com/blog/2014/04/need-sha-2-signed-root-...
- robertlagrant 5y agoLet's Encrypt was only founded in 2014, and left beta in April 2016; they just used that cert to start with IIRC. So it's been about 5 years for LE users, not 20.