Chromium and Mozilla to enforce 1 year validity for TLS certificates

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by Karunamon on Sunday June 28, 2020 @02:29PM (#23670937)

Just spinning up a CA is a couple of commands. Running one sanely (to include security of the private keys, availability and auditability of the signing machine, keeping backups, publishing a CRL, setting up ACME if you want any kind of automation) is significantly more involved.

[ Parent | on HN ]

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by Spivak on Sunday June 28, 2020 @04:36PM (#23671831)

But this is silly. If this isn’t completely trivial to add to your app then something has gone horribly wrong.

* Every machine in your infra already has backups, right? Nothing about your signing boxes are special in this regard.

* All your services are already HA, right? The API servers that now have to run some glorified OpenSSL commands aren’t any different than your normal API endpoints.

* You already have to protect secrets on your machines. DB passwords, API keys. What’s one more?

* You don’t have to implement ACME. These are your devices talking to your devices.

[ Parent | on HN ]

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by rad_gruchalski on Sunday June 28, 2020 @05:19PM (#23672146)

Nothing different than any long lived component in any infrastructure. There is no reason to look for reasons not to use a CA.

[ Parent | on HN ]