3 ms·

Given that certificate issuance is the most vulnerable part of the process (DNS hijacking during the validation process), isn't it a bad idea to encourage renew

Given that certificate issuance is the most vulnerable part of the process (DNS hijacking during the validation process), isn't it a bad idea to encourage renewing certificates so often? Plus, this is yet another blow to using TLS for networks not connected to the Internet. Asking users to go through some pain of accepting a new self-signed cert every three months, which was already worse than once a year, is going to get almost untenable at 45 days. And no one is offering any realistic alternatives.

gruez 2y ago
>Given that certificate issuance is the most vulnerable part of the process (DNS hijacking during the validation process), isn't it a bad idea to encourage renewing certificates so often? I don't get it, is the domain extra susceptible to misissuance during the renewal process? If not, I don't see how this is a relevant point.
Dylan16807 2y ago
> Given that certificate issuance is the most vulnerable part of the process (DNS hijacking during the validation process), isn't it a bad idea to encourage renewing certificates so often? If someone hijacks your domain they can get a certificate right away, no matter how long the existing certificate was valid for. > Asking users to go through some pain of accepting a new self-signed cert every three months, which was already worse than once a year, is going to get almost untenable at 45 days. Are you experiencing the former right now? I thought these policies had no impact on self-signed certs at all.
nickf 2y ago
The domain verification process is indeed a weak point - but there's now the upcoming introduction of MPIC (Multi Perspective Issuance Corroboration) to help with that (essentially checking the domain challenges from multiple network perspectives to overcome the risk of BGP-hijacking and similar attacks). Also, if there's a non-internet connected network or device that uses TLS, it shouldn't be using public/webPKI certificates. Use a private CA, get the root on the managed devices that connect to it, and the problem goes away. That's always been an option.

gruez 2y ago

>Given that certificate issuance is the most vulnerable part of the process (DNS hijacking during the validation process), isn't it a bad idea to encourage renewing certificates so often? I don't get it, is the domain extra susceptible to misissuance during the renewal process? If not, I don't see how this is a relevant point.

Dylan16807 2y ago

> Given that certificate issuance is the most vulnerable part of the process (DNS hijacking during the validation process), isn't it a bad idea to encourage renewing certificates so often? If someone hijacks your domain they can get a certificate right away, no matter how long the existing certificate was valid for. > Asking users to go through some pain of accepting a new self-signed cert every three months, which was already worse than once a year, is going to get almost untenable at 45 days. Are you experiencing the former right now? I thought these policies had no impact on self-signed certs at all.

nickf 2y ago

The domain verification process is indeed a weak point - but there's now the upcoming introduction of MPIC (Multi Perspective Issuance Corroboration) to help with that (essentially checking the domain challenges from multiple network perspectives to overcome the risk of BGP-hijacking and similar attacks). Also, if there's a non-internet connected network or device that uses TLS, it shouldn't be using public/webPKI certificates. Use a private CA, get the root on the managed devices that connect to it, and the problem goes away. That's always been an option.