3 ms·

A Note from Our Executive Director

31 points by soheilpro 2y ago

politelemon 2y ago
Key bit: > but we are going to introduce a new offering that’s a big shift from anything we’ve done before - short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.
nodesocket 2y ago
Interesting choice of 6 days. Any reason 6 was picked?
- aomix 2y ago
  I could see that value being chosen so people have no incentive to game the cert expiry. For whatever peace of mind it gives them to rotate certs only at low traffic times of the week.
- cweagans 2y ago
  If you have a 7 day expiration, some sysadmin is going to set up the renewal check on a weekly cron job. When the cert renewal fails, they don't have any time to act. 6 day expiration = you run the check daily. If something fails to renew, you might have a little more notice.
  - crote 2y ago
    Or a manual job: renew the certificate every Monday morning after grabbing your coffee.
samgranieri 2y ago
On a side note, I've had fun playing with something like this with Caddy and StepCA and bind running in a homelab. I've managed to, using the rfc2136 plugin, managed to rotate certs every ten minutes. Every six days is fine, just use something like Caddy that rotates the certs for you and it should just be set it and forget it. Yes, I realize this is a bit glib.
- crote 2y ago
  Yeah, the "just use something like Caddy" is the main issue. Most software and especially most hardware appliances aren't that progressive yet. A big part of the reason why shorter cert validity is desirable is because CAs routinely violate the mandatory revocation deadline, usually with an argument which boils down to "$BigOrg doesn't want to". And they don't want to because they have developed an extremely complicated manual process around certificate renewal, sometimes requiring weeks from end to end. Luckily most of the cert issues are primarily administrative, but it does show what the PKI infrastructure will most likely be unable to timely respond to an incident with real-world consequences. The major browsers are already planning to reduce the validity of all certificates to 90 days or even less, and LetsEncrypt serves a nice role by showing everyone that high-frequency renewal is indeed possible. After all, if a nonprofit can do it surely a well-paid CA wouldn't have any issues with it? By normalizing short certificate lifetimes they are essentially forcing the industry to innovate. Either make sure everything using certs has an API which allows for automatic renewal, or stop using the public PKI infrastructure and run your own private CA.
rurban 2y ago
Prossimo: That would be rustls, a project that bypassed openssl in every aspect by now. Really everybody should switch over. https://www.memorysafety.org/initiative/rustls/ https://www.memorysafety.org/initiative/rustls/

31 points by soheilpro 2y ago

Key bit: > but we are going to introduce a new offering that’s a big shift from anything we’ve done before - short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.

nodesocket 2y ago

Interesting choice of 6 days. Any reason 6 was picked?

aomix 2y ago
I could see that value being chosen so people have no incentive to game the cert expiry. For whatever peace of mind it gives them to rotate certs only at low traffic times of the week.
cweagans 2y ago
If you have a 7 day expiration, some sysadmin is going to set up the renewal check on a weekly cron job. When the cert renewal fails, they don't have any time to act. 6 day expiration = you run the check daily. If something fails to renew, you might have a little more notice.
- crote 2y ago
  Or a manual job: renew the certificate every Monday morning after grabbing your coffee.

samgranieri 2y ago

On a side note, I've had fun playing with something like this with Caddy and StepCA and bind running in a homelab. I've managed to, using the rfc2136 plugin, managed to rotate certs every ten minutes. Every six days is fine, just use something like Caddy that rotates the certs for you and it should just be set it and forget it. Yes, I realize this is a bit glib.

crote 2y ago
Yeah, the "just use something like Caddy" is the main issue. Most software and especially most hardware appliances aren't that progressive yet. A big part of the reason why shorter cert validity is desirable is because CAs routinely violate the mandatory revocation deadline, usually with an argument which boils down to "$BigOrg doesn't want to". And they don't want to because they have developed an extremely complicated manual process around certificate renewal, sometimes requiring weeks from end to end. Luckily most of the cert issues are primarily administrative, but it does show what the PKI infrastructure will most likely be unable to timely respond to an incident with real-world consequences. The major browsers are already planning to reduce the validity of all certificates to 90 days or even less, and LetsEncrypt serves a nice role by showing everyone that high-frequency renewal is indeed possible. After all, if a nonprofit can do it surely a well-paid CA wouldn't have any issues with it? By normalizing short certificate lifetimes they are essentially forcing the industry to innovate. Either make sure everything using certs has an API which allows for automatic renewal, or stop using the public PKI infrastructure and run your own private CA.

rurban 2y ago

Prossimo: That would be rustls, a project that bypassed openssl in every aspect by now. Really everybody should switch over. https://www.memorysafety.org/initiative/rustls/ https://www.memorysafety.org/initiative/rustls/