3 ms·
I think that a main part of LetsEncrypt security comes from renewing the certificate every 3 months. You would not be able to do that with shipped binaries.
by silvestrov 3y ago
I think that a main part of LetsEncrypt security comes from renewing the certificate every 3 months. You would not be able to do that with shipped binaries.
- andygeorge 3y agoI mean, you certainly _could_ - most users don't try to regularly reinstall the same binary they downloaded.
- notpushkin 3y agoBinaries are timestamped though. If you sign it, it's practically valid forever (unless you revoke the signature).
- Avamander 3y agoIt takes more than the signing date to assert validity at the time of signing rather than at the time of checking. This means that these signatures tend to expire when the code signing certificate or the CA itself expires.
- electroly 3y agoThat's why you get a timestamp countersignature; that's what the person you're replying to is talking about. They are absolutely correct. This is standard practice. Signed executables on Windows DO NOT lose trust when the certificate expires as long as they are cryptographically timestamped. https://learn.microsoft.com/en-us/windows/win32/seccrypto/time-stamping-authenticode-signatures https://learn.microsoft.com/en-us/windows/win32/seccrypto/ti... My first code signing certificate from long ago is already expired; the signed executables under that certificate are still trusted by Windows.