Re:Free, automated SSL certificates for Sandstorm self-hosters
by abritishguy on Monday October 05, 2015 @03:16PM
(#10334103)
It would be nice if you included the financial motivation in the article as well. Makes total sense, and I totally agree that 7 day certs are better (security wise) than 1 year, I just wasn't sure that in the absence of any financial motivation whether it would be worth the effort (having to roll private keys every week) for the limited protection it gives you.
[ Parent
| on HN ]
Re:Free, automated SSL certificates for Sandstorm self-hosters
by savant on Monday October 05, 2015 @04:05PM
(#10334482)
You eventually have to roll over keys at least once every N years, so if you are automating it, the length of time doesn't really matter.
In this case, they are just limiting the window.
Re:Free, automated SSL certificates for Sandstorm self-hosters
by kentonv on Monday October 05, 2015 @04:24PM
(#10334633)
Indeed, we were going to do the auto-renewal regardless, so making it every 7 days didn't really add any work.
Meanwhile I really am paranoid about long-lived keys of any sort, especially if they need to be online as TLS keys must. I wish CAs offered short-lived keys more readily (and web infrastructure supported it); I'd love to enable them for all Sandstorm properties.