2 ms·
Expiry is optional on certificates. You can write your own using a library like OpenSSL and it will be respected by the browsers. What you linked to was an indu
by austin-cheney 5mo ago
Expiry is optional on certificates. You can write your own using a library like OpenSSL and it will be respected by the browsers. What you linked to was an industry trade group voting on a bylaw.
- gnabgib 5mo agoHave you ever seen a no-expiry cert? Widely criticized as a mistake. The null-object of TLS. You cannot issue a publicly trusted TLS certificate with an empty expiry, or an expiry date more than 200 days away (as of March). If you want to talk about private CA, then the certs can follow all sorts of rules.. they don't even have to be about TLS.. they can be for SSH at that point.
- austin-cheney 5mo agoPeople confuse themselves on this subject all the time. Expiry is optional. Is that a good idea? No. Expiry exists only to kill a certificate, intentionally, in a timely manner. That forces the consumer to handle their business before certificate compromise, because revocation and compromise each invoke a higher effort to mitigate to the issuer.