Re:Now I understand why almost no one uses encrypted email
by austincheney on Thursday April 16, 2020 @10:29PM
(#22895673)
> Again, there's nothing in the Wikipedia link which specifies that site certificates MUST exist for a specific duration.
I never said anything like that. Web certificates are around for as long as both the website and CA are willing to service them.
Re:Now I understand why almost no one uses encrypted email
by dredmorbius on Friday April 17, 2020 @09:15AM
(#22898683)
"Websites require long term certificate retention and every year or two those certificates are replaced just like email PKI keys are"
Re:Now I understand why almost no one uses encrypted email
by austincheney on Friday April 17, 2020 @12:32PM
(#22900434)
CAs generally issue certificates to websites for 1 or 2 years, but there isn't a fixed duration imposed by cryptography standards. Sometimes the certificates are rejected prematurely due to compromise, and there is a process for that called key revocation.
I am thinking you reading something more into what I wrote than the words on the screen.
Re:Now I understand why almost no one uses encrypted email
by dredmorbius on Friday April 17, 2020 @12:56PM
(#22900707)
there isn't a fixed duration imposed by cryptography standards
Which was my point in the first place.
A distinct difference from the case of data-at-rest.
I am thinking you reading something more into what I wrote than the words on the screen.
I disagree, but suggest the same for yourself.
https://tools.ietf.org/html/rfc8446#section-4.4.2.2
If you have information otherwise please do us both the favour of quoting the relevant language from an authoritative source directly in your reply.
You're also creating a dispute based on a claim I've not made. CA keys being "distributed to all major browsers and/or operating systems", my claim, which you quote, does not preclude other distribution mechanisms. That discussion is unnecessary here.
Your understanding, generally, seems in error.
Again: TLS sever keys have no minimum duration requirement, as the Let's Encrypt description previously cited makes explicitly clear: "renewal can take place at any time".