4 ms·

Their certs expire before the deadline (only valid for 3 months) so they show up as green. They seem to get new certs every three months.

ygra 12y ago
How useful is it to get new certs that often? I always had the impression that certs live only a certain time so that revocation lists can be pruned and don't grow unbounded over time, or is there anything else to it?
- Strilanc 12y ago
  If you think a cryptosystem is weak, so that it will take years to break a key (instead of millenia), then reducing key expiration times to months seems like a good way to buy some time. And it incentivizes moving to a system that's not so weak.
- geofft 12y ago
  That's certainly part of it, but at some point there's a qualitative shift: if you make certificate lifetimes short enough, you don't need to bother with revocation lists at all. Since CRLs are unwieldy no matter how you do them, standard practice for revocation is OCSP, preferably through OCSP stapling, where you carry a signed response from the CA (valid for about a day) saying that your certificate hasn't been revoked. Effectively this is just a more complicated way of getting a new certificate about every day. The other part is that, if something about a cert turns out to have been a bad idea, it's much better to only have to wait a few days or even months than to wait a few years. "Something" could be the algorithm (precisely why Chrome is yelling at SHA-1 certs that will still be valid in 2017, even though there's no attack as of right today). It could also be certification practices: if the community decides that, say, certificates without the `subjectAltName` extension need to be deprecated because the CN field is underspecified, nobody's going to want to do revocations for that. So you are stuck waiting until all current certs expire and get renewed to follow current best practices.
- xenadu02 12y ago
  Another benefit: If you have that infrastructure in place then you don't run into problems where everyone forgot that the certificate was expiring. That error has hit so many sites/services... even huge ones with multi-million-dollar budgets and hundreds of people working on it.
jfoster 12y ago
Which means that less than 3 months ago, they got a cert which was SHA-1. Why would they do that?

ygra 12y ago

How useful is it to get new certs that often? I always had the impression that certs live only a certain time so that revocation lists can be pruned and don't grow unbounded over time, or is there anything else to it?

Strilanc 12y ago
If you think a cryptosystem is weak, so that it will take years to break a key (instead of millenia), then reducing key expiration times to months seems like a good way to buy some time. And it incentivizes moving to a system that's not so weak.
geofft 12y ago
That's certainly part of it, but at some point there's a qualitative shift: if you make certificate lifetimes short enough, you don't need to bother with revocation lists at all. Since CRLs are unwieldy no matter how you do them, standard practice for revocation is OCSP, preferably through OCSP stapling, where you carry a signed response from the CA (valid for about a day) saying that your certificate hasn't been revoked. Effectively this is just a more complicated way of getting a new certificate about every day. The other part is that, if something about a cert turns out to have been a bad idea, it's much better to only have to wait a few days or even months than to wait a few years. "Something" could be the algorithm (precisely why Chrome is yelling at SHA-1 certs that will still be valid in 2017, even though there's no attack as of right today). It could also be certification practices: if the community decides that, say, certificates without the `subjectAltName` extension need to be deprecated because the CN field is underspecified, nobody's going to want to do revocations for that. So you are stuck waiting until all current certs expire and get renewed to follow current best practices.
xenadu02 12y ago
Another benefit: If you have that infrastructure in place then you don't run into problems where everyone forgot that the certificate was expiring. That error has hit so many sites/services... even huge ones with multi-million-dollar budgets and hundreds of people working on it.

jfoster 12y ago

Which means that less than 3 months ago, they got a cert which was SHA-1. Why would they do that?