News for hackers. Stuff that matters.

A comment on SSL certificate lifetimes are going down. Dates proposed. 45 days by 2027. Parent comment

Re:SSL certificate lifetimes are going down. Dates proposed.... by gruez on Tuesday October 15, 2024 @04:24AM (#41846267)
Don't you have to go out of your way to do that? You can probably choose a weak RSA key as well (ie. one that's 4096 bits but not a prime), but if you have to go out of your way to do that there's little anyone can do to stop you.
[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by g8oz on Tuesday October 15, 2024 @09:33AM (#41848418)
No you don't have to go out of your way to reuse the same key
[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by SahAssar on Tuesday October 15, 2024 @09:59AM (#41848686)
IIRC the default in most/all ACME clients is to reuse the private key and just get a renewed certificate for it.
[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by m_sahaf on Wednesday October 16, 2024 @02:30AM (#41856175)
Caddy doesn't reuse the private key by default. The user has to explicitly configure it in that broken way.
[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by SahAssar on Wednesday October 16, 2024 @07:36AM (#41857926)
Does it terminate existing connections and re-handshake when renewing the cert then? Or does it potentially hold many keys in memory for existing sessions? IIRC a TLS session can potentially last for a long time and 0-RTT depends on it being the same key, right? Couldn't find any answers in the docs: https://caddyserver.com/docs/caddyfile/directives/tls#reuse_...
[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by m_sahaf on Thursday October 17, 2024 @02:27AM (#41866954)
The renewal of the key does not affect existing connections/sessions because they (the sessions) don't use the key directly. The private key is only used in the beginning to agree on the symmetric key, then the symmetric key is used from there onwards.
[ Parent | on HN ]