3 ms·
There is no limitation in TLS preventing you from cycling your keys every 24 hours. Most CAs let you do unlimited reissuance. It makes public key pinning hard (
by iancarroll 11y ago
There is no limitation in TLS preventing you from cycling your keys every 24 hours. Most CAs let you do unlimited reissuance. It makes public key pinning hard (impossible?), though.
- rakoo 11y ago> It makes public key pinning hard (impossible?), though. In this case you don't pin the server's key but the "central" key.
- sneak 11y agoThis doesn't really work without the certificate expiration date also being 24-48h in the future, though. I think they reissue the same 1y+ validity cert...
- iancarroll 11y agoSome allow manually specifying the expiration times.
- skuhn 11y agoEntrust, for instance, allows you to purchase certs essentially on a subscription plan. You may have one valid cert for 3 years (and pay the reduced 3 year rate), and reissue it with 24 hour expirations every day. I personally wouldn't go with an expiration that low because of the operational overhead, but a few weeks or a month is attractive. It still significantly limits the downside potential versus 1-3 year certs. Basically any cert (non-root) over 1 year should be considered against best practice at this point.