DigiCert Revocation Incident (CNAME Domain Validation)

Re:DigiCert Revocation Incident (CNAME Domain Validation) by CaliforniaKarl on Tuesday July 30, 2024 @08:37PM (#41115477)

> Stuff like this is why some parties have been calling for increasingly-shorter cert validity. When a cert is valid for several years it allows companies to develop an increasingly complex workflow around deploying them, sometimes taking weeks and involving dozens of parties to roll them out. This is in turn used as an excuse by CAs to completely ignore the industry standards.

"several years"? The certs we are getting have one-year lifetimes. It used to be two years, but was reduced to one year some time ago (I don't remember exactly when).

Also, I don't think the problem is cert lifetimes, I think the problem is having so many certs expiring all at the same time. A lot of IT folks are coming off the major pain of the CrowdStrike crash. This is similar: You suddenly have a very large number of certificates that are going to stop working in less than 24 hours, and you have to respond.

Sure, you could say "Well, companies should be resourced to be able to handle that at any point." Except that's not the reality right now.

[ Parent | on HN ]

Re:DigiCert Revocation Incident (CNAME Domain Validation) by devrand on Tuesday July 30, 2024 @08:49PM (#41115545)

I think they're suggesting that 1 year certificates are still at the point where people can just manually rotate them as they expire. If you keep reducing the lifespan, to say 90 days, that starts to tip the scale. You'll be spending too much human time manually rotating certificates that it will make financial sense to just automate the process.

If the process is automated then revocation can be automatically handled as well (so long as ARI gains traction).

[ Parent | on HN ]

Re:DigiCert Revocation Incident (CNAME Domain Validation) by icedchai on Tuesday July 30, 2024 @10:49PM (#41116029)

I work with customers that typically take 3 or 4 days to either acquire or renew a cert. Even though they are on one of the major cloud provider with automated certs, they refuse to use those mechanisms due to policy. They would rather send everything, including private keys, through email. They also take several days, sometimes weeks, to update a DNS entry. Welcome to modern IT.

[ Parent | on HN ]

Re:DigiCert Revocation Incident (CNAME Domain Validation) by alex34778 on Thursday August 01, 2024 @02:02PM (#41131787)

Trying to deploy SaaS apps for customers it sometimes takes 3-4 weeks to get them to make any DNS changes, then at the last minute they CC us into an email with SquareSpace support for some reason (their DNS is on Cloudflare...)

[ Parent | on HN ]

Re:DigiCert Revocation Incident (CNAME Domain Validation) by icedchai on Thursday August 01, 2024 @05:06PM (#41133625)

I believe it. It's insane how long some of this stuff takes.

[ Parent | on HN ]

Re:DigiCert Revocation Incident (CNAME Domain Validation) by nickf on Wednesday July 31, 2024 @03:54AM (#41117181)

90 day certificates will be here soon, and moving to shorter lifetimes from there.

[ Parent | on HN ]

Re:DigiCert Revocation Incident (CNAME Domain Validation) by devrand on Wednesday July 31, 2024 @01:57PM (#41121510)

Heck, subscribers could go to 10 day certs today (soon 7) and be immune from revocation entirely.

[ Parent | on HN ]