Spanish police plans to extend use of its lie-detector while efficacy is unclear

Re:Spanish police plans to extend use of its lie-detector wh... by Hokusai on Tuesday October 27, 2020 @09:14AM (#24907060)

> yearly the root certificates need to be changed for reasons that escape my understanding

It is not needed yearly. The validity is 4 years for "personal" certificates: https://www.sede.fnmt.gob.es/preguntas-frecuentes/problemas-...

> (the root certificates are not trusted by your OS or browser

You can use the Automatic Configurator. Just run the "Configurador FNMT-RCM.". It should help your less tech savvy acquaintances.

> we received a copy from the notary with the official documents of the property registration, which included as an annex a printed XML with the GML detailing the limits of the property.

That's funny, but I agree it is a missed opportunity.

[ Parent | on HN ]

Re:Spanish police plans to extend use of its lie-detector wh... by pa7x1 on Tuesday October 27, 2020 @11:00AM (#24908053)

Thanks for the tips and clarifications.

> It is not needed yearly. The validity is 4 years for "personal" certificates:

Indeed, the "personal" certificate is invalidated each 4 years and you have to visit the police to get a new one.

What I meant is that the root (or subordinates) certificates of the FNMT are revoked with a surprisingly high frequency. With "yearly" I mean that roughly every year I have to see what's up with the certificates on my dad's computer as he complains he cannot log in anymore to AEAT, at first I assumed he misconfigured something but nope it's the public certificate of the root or subordinate CAs that have to be changed as the previous ones are revoked. This is done with a noticeably higher frequency than needed.

This has happened several times and always leaves me baffled as what could be the reason.

[ Parent | on HN ]

Re:Spanish police plans to extend use of its lie-detector wh... by yokaze on Wednesday October 28, 2020 @04:40PM (#24923870)

> I mean that roughly every year I have to see what's up with the certificates on my dad's computer as he complains he cannot log in anymore to AEAT, at first I assumed he misconfigured something but nope it's the public certificate of the root or subordinate CAs that have to be changed as the previous ones are revoked

Are you sure? As far as I know, your OS doesn't need to recognise the root certificate to authenticate yourself towards a web-server, the web-server needs to know it.

At least when I was working with client certificates, I was working with a self-signed one, and I didn't need to register my CA, I just dropped it with the web-server, which was doing the validation.

I tried it now with a MacOS, and the certificate is marked as not trusted, but I can present it to the server, and it validates it.

> Indeed, the "personal" certificate is invalidated each 4 years and you have to visit the police to get a new one.

As I read it, you can renovate it online 60 days before expiry: https://www.sede.fnmt.gob.es/en/certificados/persona-fisica/...

Also rather with the AEAT, if you prefer.

[ Parent | on HN ]