Google wants to reduce lifespan for HTTPS certificates to one year

Re:Google wants to reduce lifespan for HTTPS certificates to... by t0mas88 on Sunday August 18, 2019 @03:51AM (#20728841)

Some systems aren't internet connected 24/7 and thus not able to autorenew all the time.

Not a problem if someone has to do it manually every year or two years, but it becomes a bigger issue if you need to renew a cert every 30 days.

[ Parent | on HN ]

Re:Google wants to reduce lifespan for HTTPS certificates to... by throw0101a on Sunday August 18, 2019 @07:54PM (#20733726)

Also, some systems are internal only, so can't use http-01 validation.

We have a bunch of these like this, so for our "foo.int.example.com" systems, in our public DNS we have a CNAME pointing to "foo.int.dnsauth.example.com", and have set up a new DNS infrastructure so that we can use dns-01 validation of TXT records there:

* https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode

* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/

* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

I had no idea that this functionality existed until fairly recently.

[ Parent | on HN ]

Re:Google wants to reduce lifespan for HTTPS certificates to... by AstralStorm on Monday August 19, 2019 @10:32AM (#20738071)

And the DNSSEC is authenticated with how often renewed certificate?

If there's no DNSSEC, this is entirely worthless. DNS is very easy to attack.

[ Parent | on HN ]

Re:Google wants to reduce lifespan for HTTPS certificates to... by tptacek on Monday August 19, 2019 @07:22PM (#20742616)

CAs are in general CT-logged now, and major sites all monitor the CT logs (hell, even small sites do at this point). If it's so easy to attack DNS to achieve misissuance, why isn't it happening all the time?

[ Parent | on HN ]