News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by ithkuil on Sunday June 28, 2020 @05:45PM (#23672327)
That works fine with a brand new device you just unboxed. But what should happen 3 years later? Should the IoT device have a certificate that is valid forever?
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by paledot on Sunday June 28, 2020 @06:05PM (#23672454)
I would say yes, as long as certificates are unique per-device. The harm of my light bulb's cert being compromised is less than the harm of my light bulb no longer working if the manufacturer's CA goes offline and it can't renew its cert.
[ Parent | on HN ]