3 ms·
What does reducing validity actually solve? The same private key is presumably used by all certificates and CSRs - if the private key is compromised then a rene
by hsbauauvhabzb 2y ago
What does reducing validity actually solve? The same private key is presumably used by all certificates and CSRs - if the private key is compromised then a renewed cert doesn’t solve anything.
Am I missing something here?
- spacebanana7 2y agoThe only thing I can think of is domain expiry. Someone could get a certificate, sell their domain, then continue using the cert until the certificate expires.
- Arnavion 2y agoYou're supposed to use a new private key for the new CSR. There is no reason to reuse the previous key.
- hsbauauvhabzb 2y agoAnd what’s the value in that? If a system is breached then the keys should end up revoked by ocsp?
- chippiewill 2y ago> The same private key is presumably used by all certificates and CSRs That's a choice. Certbot changes the private key with every renewal by default. I suppose in principle CAB might start disallowing key reuse.
- ta8645 2y agoMy tinfoil hat says it's about control. Forcing people to return for another blessing from the central authority, more often. The same reason church is once a week, and not once a year.
- appendix-rock 2y ago[flagged]