6 ms·

Is there any actual benefit to auto-expiring SSL certs? Presumably if your SSL cert is leaked, you would like to have the ability to revoke it without waiting a

Is there any actual benefit to auto-expiring SSL certs? Presumably if your SSL cert is leaked, you would like to have the ability to revoke it without waiting a full year or whatever. On the flip side, if your SSL cert isn’t leaked it benefits quite precisely nobody to have it become invalid just because a caesium-133 atom has gone through however many transitions. The only benefit I’ve heard voiced is that it forces organizations to develop processes for cycling said certs - but that’s absolutely bogus. Imagine if S3 auto-deleted all buckets after a number of days and said “This is a good thing! Us auto-deleting these buckets forces you to set up processes to deal with us auto-deleting these buckets! You’re welcome.”

kobalsky 3y ago
the custom probably comes from the era when people had to pay for SSL certificates, but it's still good security hygiene. it's easy to revoke a certificate that you know was compromised, but what if you don't know it was? a temporal security gap could expose your eternal private key. with a short shelf-life it doesn't give attackers a lot of room to maneuver. otherwise, they could wait for an opportunity to chain it with another exploit and really ruin your day.
sbierwagen 3y ago
Scenario: you register foo.com and generate a certificate. You get bored and let the domain lapse. A decade later, a bank re-registers the domain. At best, they can only revoke your cert after it's used in a MITM attack, and a single fraudulent bank transfer from a rich person can net you a million bucks.
- explaininjs 3y ago
  Is it impossible to query for (then revoke) existing certs for a domain you have just acquired? If not, that seems like the system failure here. Otherwise you have a ~year of MITM to worry about for any domain you obtain, regardless of expirations.

kobalsky 3y ago

the custom probably comes from the era when people had to pay for SSL certificates, but it's still good security hygiene. it's easy to revoke a certificate that you know was compromised, but what if you don't know it was? a temporal security gap could expose your eternal private key. with a short shelf-life it doesn't give attackers a lot of room to maneuver. otherwise, they could wait for an opportunity to chain it with another exploit and really ruin your day.

sbierwagen 3y ago

Scenario: you register foo.com and generate a certificate. You get bored and let the domain lapse. A decade later, a bank re-registers the domain. At best, they can only revoke your cert after it's used in a MITM attack, and a single fraudulent bank transfer from a rich person can net you a million bucks.

explaininjs 3y ago
Is it impossible to query for (then revoke) existing certs for a domain you have just acquired? If not, that seems like the system failure here. Otherwise you have a ~year of MITM to worry about for any domain you obtain, regardless of expirations.