3 ms·
Unrelated to the marketing attempt here but it should be noted that the CA Browser forum voted to drastically shorten certificate lifetimes. Look for 200 day ex
by riffic 1y ago
Unrelated to the marketing attempt here but it should be noted that the CA Browser forum voted to drastically shorten certificate lifetimes. Look for 200 day expiration cycles starting next year, 100 days in 2027, and 47 days in 2029.
- wang_li 1y agoCAs need to go away. They’re untrustworthy and their inclusion in browsers and OSes seems largely unregulated.
- ignaciovdk 1y agoThat’s a sentiment I hear a lot, and honestly, not without reason. The trust model behind public CAs is… fragile at best. Misissuances, opaque root store politics, and uneven auditing make it feel like we’re outsourcing security to a cartel. But until there’s a widely adopted alternative (DANE, peer-to-peer trust, Web of Trust 2.0?), we’re stuck maintaining vigilance within this system. And unfortunately, the shorter cert lifecycles and increasing complexity only make that harder.
- ignaciovdk 1y agoAbsolutely, this shift toward shorter cert lifetimes is going to make monitoring even more critical. Automation will help, but with 90-, 100-, and eventually 47-day cycles, the margin for unnoticed renewal failures shrinks fast. One bad deploy, broken ACME challenge, or DNS hiccup, and you’re suddenly inside the failure window before anyone notices. It’s a good time for teams to review their cert workflows, not just issuance, but visibility and alerting too. I built SSL Guardian with that trend in mind, but even if you’re rolling your own monitoring, this change is going to raise the bar for how tightly we need to watch certs.