3 ms·
That isn’t why certs expire. If a hacker could crack the key in some time that is longer than the expiry but short enough to be a threat, they could instead jus
by cortesoft 3y ago
That isn’t why certs expire. If a hacker could crack the key in some time that is longer than the expiry but short enough to be a threat, they could instead just spend that time cracking the signing key that verifies the cert signature… then, the hacker could generate as many trusted certs as they want for for any domain.
- oasisbob 3y agoThat's exactly why SHA1 was deprecated in TLS certs. https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html https://security.googleblog.com/2015/12/an-update-on-sha-1-c... Even OCSP was affected: https://cabforum.org/2022/01/26/ballot-sc53-sunset-for-sha-1-ocsp-signing/ https://cabforum.org/2022/01/26/ballot-sc53-sunset-for-sha-1...
- cortesoft 3y agoI wasn't trying to say that brute force wasn't a risk, just that it wasn't why certainly expire