Comment on Decreasing Certificate Lifetimes to 45 Days

cupcakezealot@piefed.blahaj.zone ⁨7⁩ ⁨hours⁩ ago

• dan@upvote.au ⁨7⁩ ⁨hours⁩ ago

  Yes, this requirement comes from the CA/Browser Forum, which is a group consisting of all the major certificate authorities (like DigiCert, Comodo/Sectigo, Let’s Encrypt, GlobalSign, etc) plus all the major browser vendors (Mozilla, Google, and Apple). Changes go through a voting process.

  source

  • fluckx@lemmy.world ⁨6⁩ ⁨hours⁩ ago

    Don’t worry they’ll reduce the cost of certificates proportionally to the longevity of the certificate.

    Right? Anybody?

    << Cricket noises >>

    source

    • dan@upvote.au ⁨45⁩ ⁨minutes⁩ ago

      DigiCert have said they’re not changing their prices as a result. It’s still a yearly payment.

      source
    • Passerby6497@lemmy.world ⁨2⁩ ⁨hours⁩ ago

      Lol, never had to buy a cert huh?

      You’re still buying a year or more at a time, no matter the lifetime of the cert itself. Even if the cert lifetime was a week, you’re still buying the same product, no matter how many times you rotate it.

      source

      • fluckx@lemmy.world ⁨2⁩ ⁨hours⁩ ago

        Personally? No I’ve never bought a cert before. Given there’s free alternatives and it’s a homelab it doesn’t make sense. Otherwise I’ve used them on AWS, where ACM also just provides them for free.

        What you’re saying is that certificate providers will still charge you and provide certificates for a year, but just provide you with N certificates to span that year?

        E.g. if the duration is 45 days then they will give you 365/45 certificates ?

        source

        • -> View More Comments
• atzanteol@sh.itjust.works ⁨7⁩ ⁨hours⁩ ago

  It’s being deiven by the browsers. Shorter certs mean less time for a compromised certificate to be causing trouble.

  cabforum.org/working-groups/…/requirements/

  source

  • helix@feddit.org ⁨6⁩ ⁨hours⁩ ago

    most trouble is probably caused in the first few days. Doesn’t matter if it’s 45 or 90 days, it would have to be a few hours to be meaningfully short. Given that automating things like this is annoying sometimes, you’ll be sure people will max out the 45 days…

    I’m pretty sure it’s the SSL seller lobby just wanting more money, tbh. Selling snake oil security.

    source

    • Passerby6497@lemmy.world ⁨2⁩ ⁨hours⁩ ago

      Given that automating things like this is annoying sometimes, you’ll be sure people will max out the 45 days…

      I know from professional experience that this is a stupid as fuck idea that leads to outages. One of the many reasons I’m working to automate those annoying ones.

      source
    • mbirth@lemmy.ml ⁨3⁩ ⁨hours⁩ ago

      I’m pretty sure it’s the SSL seller lobby just wanting more money, tbh. Selling snake oil security.

      And selling “certificate automation” tools.

      source
    • False@lemmy.world ⁨4⁩ ⁨hours⁩ ago

      Yeah you can still do a lot of damage in a few hours, but 45 days is a meaningful reduction in exposure time from year+

      source