News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by loeg on Sunday June 28, 2020 @02:07PM (#23670736)
The mechanism SSH uses is called Trust on First Use ("TOFU") and is closer to what used to be HTTPS certificate pinning. In this scheme, certificates never expire, and if they do, clients warn about the unexpected change in certificate.

It is different from the CA PKI system, where the client trusts any certificate signed by a trusted CA without prompting the user at all, and doesn't prompt the user if the certificate for a site changes.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by zozbot234 on Sunday June 28, 2020 @02:24PM (#23670892)
Self-signed certificates give you basically this. It's a bit of a hassle to mark them as trusted, but you only have to do it once.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by loeg on Monday June 29, 2020 @12:49AM (#23674445)
That has not been my experience with current versions of Chrome.
[ Parent | on HN ]