5 ms·
You frequently saw even large sites being down with an expired HTTPS certificate in the past, for days, or even longer. And if you mess up your HSTS headers, w
by teddyh 3y ago
You frequently saw even large sites being down with an expired HTTPS certificate in the past, for days, or even longer. And if you mess up your HSTS headers, what recourse do you have? None, from what I recall.
- viraptor 3y agoIf you get an expired certificate, you can fix it close to immediately. It's all under your control. For dnssec you can't do anything until the cache expires. If the large sites were down for days because of expiry that's their own failures, not because of unexpected complexity.
- teddyh 3y ago> If you get an expired certificate, you can fix it close to immediately. Now you can. But getting a new certificate used to be a slow process. And you could still mess up irrevocably by mis-issuing HSTS headers, in which case you would just have to wait until those time out.