> Do you have an example of this happening? I know I remember a few cases that sound similar, but weakening of a signature, or key is very different from it bre

> Do you have an example of this happening? I know I remember a few cases that sound similar, but weakening of a signature, or key is very different from it breaking. Flame (back in 2012) was a pretty famous example of certificate forgery due to weak hash choice (MD5) and other operational weaknesses in the PKI (predictable serial numbers, if I remember correctly). > Do something needlessly, so that it's easy to do it when it becomes required is operations not engineering. I don't think that's a good interpretation of what 'agwa meant. I'm pretty sure he meant that it's considered good engineering practice to build systems that don't encourage the normalization of deviance, which long-lived certificates combined with manual rotation procedures historically have. Or put another way: automatic rotation procedures ensure the isostability of a PKI, rather than its brittle stability.