4 ms·
That's useless. A compromised CA could create a certificate for an arbitrary start and expiration date. So this only penalises users who have had a certificate
by richardwhiuk 12y ago
That's useless. A compromised CA could create a certificate for an arbitrary start and expiration date. So this only penalises users who have had a certificate legitimately, and doesn't work at all if the CA's crown jewels are stolen.
- AnthonyMouse 12y ago> That's useless. A compromised CA could create a certificate for an arbitrary start and expiration date. Sure, next month they could still be issuing certificates that expire in 23 months and they would be valid. But a year from then they'll only be able to issue certificates that expire in 11 months, and after two years they'll only be able to issue certificates that are already expired.
- pyre 12y agoAn arbitrary start and end date means that you could post-date the certificate to be good for two years starting from 1 year ago, even though you created it today. That's what the parent post is talking about. [edit: You're right. Even w/ arbitrary dates, end dates crossing the threshold will still not be accepted.]
- deleted 12y ago[deleted]
- nodata 12y agoHis idea deals with the problem of CAs having no incentive to do their job properly: they won't lose their ability to issue certs. You are addressing the other problem: CRLs essentially.