4 ms·

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are do

by bigstrat2003 10mo ago

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

Sohcahtoa82 10mo ago
It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.
- wang_li 10mo ago
  My browser on my work laptop has 219 root certificates trusted. Some of those may be installed from my employer, but I suspect most of them come from MS as it's Edge on Windows 11. I see in that list things like "Swedish Government Root Authority" "Thailand National Root Certification Authority" "Staat der Nederlanden Root CA" and things like "MULTICERT Root Certification Authority" "ACCVRAUZ1". I don't think there is any reason to believe any certificate. If a government wants a cert for a given DNS they will get it, either because they directly control a trusted root CA, or because they will present a warrant to a company that wants to do business in their jurisdiction and said company will issue the cert. TLS certs should be treated much more akin to SSH host keys in the known hosts file. Browsers should record the cert the first time they see it and then warn me if it changes before it's expiration date, or some time near the expiration date.
  - londons_explore 10mo ago
    Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked. Obviously you might still be victim #1 of such a scheme... But in general the CA's now aren't really trusted anymore - the real root of trust is the CT logs.
    - PunchyHamster 10mo ago
      > Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked. the ENTIRE reason the short lifetime is used for the LE certs is that they haven't figured out how to make revoking work at scale. Now if you're on latest browser you might be fine but any and every embedded device have their root CAs updated only on software update, which means compromise of CA might easily get access to hundreds of thousands devices.
      - Dylan16807 10mo ago
        > the ENTIRE reason the short lifetime is used for the LE certs is that they haven't figured out how to make revoking work at scale. And 200 is not "at scale". The list of difficulties in revoking roots is a very different list from the problem you're citing. > any and every embedded device Yes it's flawed but it's so much better than the previous nothing we had for detecting one of the too-many CAs going rogue.
  - jofla_net 10mo ago
    >> TLS certs should be treated much more akin to SSH host keys in the known hosts file. Browsers should record the cert the first time they see it and then warn me if it changes before it's expiration date, or some time near the expiration date. This is great, and actually constructive! I use, a hack i put together http://www.jofla.net/php__/CertChecker/ http://www.jofla.net/php__/CertChecker/ to keep a list (in json) of a bunch of machines (both https and SSH) and the last fingerprints/date it sees. Every time it runs i can see if any server has changed, just is a heads-up for any funny business. Sure its got shortcommings, it doesnt mimmic headers and such but its a start. It would be great if browsers could all, you know, have some type of distributed protocol, ie DHT where by at least some concensus about whether this cert has been seen by me or enough peers lately. Having a ton of CAs and the ability to have any link in that chain sing for ANY site is crazy, and until you've seen examples of abuse you assume the foundations are sound.
- NoahZuniga 10mo ago
  > broken by some government agency or hacker group Probably not. For browsers to accept this certificate it has to be logged in a certificate transparency log for anyone to see, and no such certificates have been seen to be logged.
- vbezhenar 10mo ago
  I'm not sure it is about security. For security, CRLs and OCSP were a thing from the beginning. Short-lived certificates allow to cancel CRLs or at least reduce their size, so CA can save some expenses (I guess it's quite a bit of traffic for every client to download CRLs for entire letsencrypt).
- woodruffw 10mo ago
  One of the ideas behind short-lived certificates is to put certificate lifetimes within the envelope of CRL efficacy, since CRLs themselves don’t scale well and are a significant source of operational challenges for CAs. This makes sense from a security perspective, insofar as you agree with the baseline position that revocations should always be honored in a timely manner.
alibarber 10mo ago
Well they offer a money-back guarantee. And other providers of SSL certificates exist.
- jsheard 10mo ago
  For better or worse the push down to 47-day certificates is an industry-wide thing, in a few years no provider will issue certificates for longer than that. Nobody is being forced to use 6-day certs for domains though, when the time comes Let's Encrypt will default to 47 days just like everyone else.
  - singpolyma3 10mo ago
    > Nobody is being forced to use 6-day certs for domains though Yet
    - einsteinx2 10mo ago
      Nobody is being forced to use Let’s Encrypt either.
      - singpolyma3 10mo ago
        It doesn't matter. Google makes sure every CA has the same rules.
  - hungryhobbit 10mo ago
    And you don't think that years ago people would have said "of course you'll be able to keep your security cert for more than two months"? The people who innovate in security are failing to actually create new ways to verify things, so all that everyone else in the security industry can do to make things more secure is shorten the cert expiration. It's only logical that they'll keep doing it.
    - themafia 10mo ago
      ALPN per transaction certificates. Why take the chance?
jdsully 10mo ago
At some point it makes sense to just let us use self signed certs. Nobody believes SSL is providing attestation anyways.
- vimda 10mo ago
  A lot corporate environments load their root cert and MITM you anyway
  - sgjohnson 10mo ago
    A lot of applications implement cert pinning for this exact reason
- woodruffw 10mo ago
  What does attestation mean in this context? The point of the Web PKI is to provide consistent cryptographic identity for online resources, not necessarily trustworthy ones. (The classic problem with self-signed certs being that TOFU doesn’t scale to millions of users, particularly ones who don’t know what a certificate fingerprint is or what it means when it changes.)
- cpach 10mo ago
  Then you might as well get rid of TLS altogether.
  - jdsully 10mo ago
    You'd still want in transit encryption. There are other methods than centralized trust like fingerprinting to detect forgeries.
    - cpach 10mo ago
      Haven’t seen any such system that scales to billions of user.
jofla_net 10mo ago
Rule by the few, us little people don't matter. Thing is, NOTHING, is stopping anyone from already getting short lived certs and being 'proactive' and rotating through. What it is saying is, well, we own the process so we'll make Chrome not play ball with your site anymore unless you do as we say... The CA system has cracks, that short lived certs don't fix, so meanwhile we'll make everyone as uncomfortable as possible while we rearrange deck chairs. awaiting downvotes in earnest.
akerl_ 10mo ago
Which wider world? These changes are coming from the CAB forum, which includes basically every entity that ships a popular web browser and every entity that ships certificates trusted in those browsers. There are use cases for certificates that exist outside of that umbrella, but they are by definition niche.
- michaelt 10mo ago
  About 99.99% of people and organisations are neither CAs nor Browsers. Hence they have no representation in the CAB Forum. Hardly 'by definition niche' IMHO.
  - akerl_ 10mo ago
    The pitch here wasn't that only a few people get a vote, it was that the people making the decisions aren't aware of how "the wider world" works. And they are, clearly. The people making Chrome/Firefox and the people running the CAs every publicly-trusted site uses are aware of what their products do, and how they are used.
    - themafia 10mo ago
      They're aware of the major use cases. I doubt the minority cases are even on their radar. So great for E-Commerce, not so great for anyone else.
- nottorp 10mo ago
  >which includes basically every entity that ships a popular web browser and every entity that ships certificates trusted in those browsers. So no one that actually has to renew these certificates. Hey! How long does a root certificate from a certificate authority last? 10 to 25 years? Why don't those last 120 minutes? They're responsible for the "security" of the whole internet aren't they?
  - akerl_ 10mo ago
    It's almost like the threat models for CA and leaf certs are different.
JackSlateur 10mo ago
How are things done in the wider world ? In your answer (and excluding those using ACME): is this a good behavior (that should be kept) or a lame behavior (that we should aim to improve) ? Shorter and shorter cert lifetime is a good idea because it is the only way to effectively handle a private key leak. Better idea might exist but nobody found one yet

The push for shorter and shorter cert lifetimes is a really poor idea, and indicates that the people working on these initiatives have no idea how things are done in the wider world.

Sohcahtoa82 10mo ago

It's really security theater, too. Though if I may put on my tinfoil hat for a moment, I wonder if current algorithms for certificate signing have been broken by some government agency or hacker group and now they're able to generate valid certificates. But I guess if that were true, then shorter cert lives wouldn't save you.

wang_li 10mo ago
My browser on my work laptop has 219 root certificates trusted. Some of those may be installed from my employer, but I suspect most of them come from MS as it's Edge on Windows 11. I see in that list things like "Swedish Government Root Authority" "Thailand National Root Certification Authority" "Staat der Nederlanden Root CA" and things like "MULTICERT Root Certification Authority" "ACCVRAUZ1". I don't think there is any reason to believe any certificate. If a government wants a cert for a given DNS they will get it, either because they directly control a trusted root CA, or because they will present a warrant to a company that wants to do business in their jurisdiction and said company will issue the cert. TLS certs should be treated much more akin to SSH host keys in the known hosts file. Browsers should record the cert the first time they see it and then warn me if it changes before it's expiration date, or some time near the expiration date.
- londons_explore 10mo ago
  Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked. Obviously you might still be victim #1 of such a scheme... But in general the CA's now aren't really trusted anymore - the real root of trust is the CT logs.
  - PunchyHamster 10mo ago
    > Certificate transparency effectively means that any government actually uses a false certificate on the wider web and their root cert will get revoked. the ENTIRE reason the short lifetime is used for the LE certs is that they haven't figured out how to make revoking work at scale. Now if you're on latest browser you might be fine but any and every embedded device have their root CAs updated only on software update, which means compromise of CA might easily get access to hundreds of thousands devices.
    - Dylan16807 10mo ago
      > the ENTIRE reason the short lifetime is used for the LE certs is that they haven't figured out how to make revoking work at scale. And 200 is not "at scale". The list of difficulties in revoking roots is a very different list from the problem you're citing. > any and every embedded device Yes it's flawed but it's so much better than the previous nothing we had for detecting one of the too-many CAs going rogue.
- jofla_net 10mo ago
  >> TLS certs should be treated much more akin to SSH host keys in the known hosts file. Browsers should record the cert the first time they see it and then warn me if it changes before it's expiration date, or some time near the expiration date. This is great, and actually constructive! I use, a hack i put together http://www.jofla.net/php__/CertChecker/ http://www.jofla.net/php__/CertChecker/ to keep a list (in json) of a bunch of machines (both https and SSH) and the last fingerprints/date it sees. Every time it runs i can see if any server has changed, just is a heads-up for any funny business. Sure its got shortcommings, it doesnt mimmic headers and such but its a start. It would be great if browsers could all, you know, have some type of distributed protocol, ie DHT where by at least some concensus about whether this cert has been seen by me or enough peers lately. Having a ton of CAs and the ability to have any link in that chain sing for ANY site is crazy, and until you've seen examples of abuse you assume the foundations are sound.
NoahZuniga 10mo ago
> broken by some government agency or hacker group Probably not. For browsers to accept this certificate it has to be logged in a certificate transparency log for anyone to see, and no such certificates have been seen to be logged.
vbezhenar 10mo ago
I'm not sure it is about security. For security, CRLs and OCSP were a thing from the beginning. Short-lived certificates allow to cancel CRLs or at least reduce their size, so CA can save some expenses (I guess it's quite a bit of traffic for every client to download CRLs for entire letsencrypt).
woodruffw 10mo ago
One of the ideas behind short-lived certificates is to put certificate lifetimes within the envelope of CRL efficacy, since CRLs themselves don’t scale well and are a significant source of operational challenges for CAs. This makes sense from a security perspective, insofar as you agree with the baseline position that revocations should always be honored in a timely manner.

alibarber 10mo ago

Well they offer a money-back guarantee. And other providers of SSL certificates exist.

jsheard 10mo ago
For better or worse the push down to 47-day certificates is an industry-wide thing, in a few years no provider will issue certificates for longer than that. Nobody is being forced to use 6-day certs for domains though, when the time comes Let's Encrypt will default to 47 days just like everyone else.
- singpolyma3 10mo ago
  > Nobody is being forced to use 6-day certs for domains though Yet
  - einsteinx2 10mo ago
    Nobody is being forced to use Let’s Encrypt either.
    - singpolyma3 10mo ago
      It doesn't matter. Google makes sure every CA has the same rules.
- hungryhobbit 10mo ago
  And you don't think that years ago people would have said "of course you'll be able to keep your security cert for more than two months"? The people who innovate in security are failing to actually create new ways to verify things, so all that everyone else in the security industry can do to make things more secure is shorten the cert expiration. It's only logical that they'll keep doing it.
  - themafia 10mo ago
    ALPN per transaction certificates. Why take the chance?

jdsully 10mo ago

At some point it makes sense to just let us use self signed certs. Nobody believes SSL is providing attestation anyways.

vimda 10mo ago
A lot corporate environments load their root cert and MITM you anyway
- sgjohnson 10mo ago
  A lot of applications implement cert pinning for this exact reason
woodruffw 10mo ago
What does attestation mean in this context? The point of the Web PKI is to provide consistent cryptographic identity for online resources, not necessarily trustworthy ones. (The classic problem with self-signed certs being that TOFU doesn’t scale to millions of users, particularly ones who don’t know what a certificate fingerprint is or what it means when it changes.)
cpach 10mo ago
Then you might as well get rid of TLS altogether.
- jdsully 10mo ago
  You'd still want in transit encryption. There are other methods than centralized trust like fingerprinting to detect forgeries.
  - cpach 10mo ago
    Haven’t seen any such system that scales to billions of user.

jofla_net 10mo ago

Rule by the few, us little people don't matter. Thing is, NOTHING, is stopping anyone from already getting short lived certs and being 'proactive' and rotating through. What it is saying is, well, we own the process so we'll make Chrome not play ball with your site anymore unless you do as we say... The CA system has cracks, that short lived certs don't fix, so meanwhile we'll make everyone as uncomfortable as possible while we rearrange deck chairs. awaiting downvotes in earnest.

akerl_ 10mo ago

Which wider world? These changes are coming from the CAB forum, which includes basically every entity that ships a popular web browser and every entity that ships certificates trusted in those browsers. There are use cases for certificates that exist outside of that umbrella, but they are by definition niche.

michaelt 10mo ago
About 99.99% of people and organisations are neither CAs nor Browsers. Hence they have no representation in the CAB Forum. Hardly 'by definition niche' IMHO.
- akerl_ 10mo ago
  The pitch here wasn't that only a few people get a vote, it was that the people making the decisions aren't aware of how "the wider world" works. And they are, clearly. The people making Chrome/Firefox and the people running the CAs every publicly-trusted site uses are aware of what their products do, and how they are used.
  - themafia 10mo ago
    They're aware of the major use cases. I doubt the minority cases are even on their radar. So great for E-Commerce, not so great for anyone else.
nottorp 10mo ago
>which includes basically every entity that ships a popular web browser and every entity that ships certificates trusted in those browsers. So no one that actually has to renew these certificates. Hey! How long does a root certificate from a certificate authority last? 10 to 25 years? Why don't those last 120 minutes? They're responsible for the "security" of the whole internet aren't they?
- akerl_ 10mo ago
  It's almost like the threat models for CA and leaf certs are different.

JackSlateur 10mo ago

How are things done in the wider world ? In your answer (and excluding those using ACME): is this a good behavior (that should be kept) or a lame behavior (that we should aim to improve) ? Shorter and shorter cert lifetime is a good idea because it is the only way to effectively handle a private key leak. Better idea might exist but nobody found one yet