News for hackers. Stuff that matters.

A comment on SSL certificate lifetimes are going down. Dates proposed. 45 days by 2027. Parent comment

Re:SSL certificate lifetimes are going down. Dates proposed.... by ndsipa_pomu on Tuesday October 15, 2024 @11:13AM (#41849468)
I'd classify that as very low risk. If a CA's business is compromised by a government, then it's pretty easy to just switch to using a different CA, preferably in a different jurisdiction to work around the censorship.

I don't really get the argument behind using HTTP links to avoid the censorship risk with HTTPS - just provide both and get the best of both worlds. Also, using HTTP is far more prone to being interfered with in transit - I recall BT (or their ISP business department) trialling that and injecting adverts into HTTP pages. I can't recall any instance of HTTPS being censored by restricting certificates.

[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by hulitu on Tuesday October 15, 2024 @01:51PM (#41851112)
> I'd classify that as very low risk.

The majority of CAs are in the US.

[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by ndsipa_pomu on Tuesday October 15, 2024 @02:14PM (#41851402)
Whilst that could be a problem, there are some CAs that aren't based in the US. I consider it a low risk issue as I haven't heard of it happening. It'd be more likely for your IP to be cut off rather than attempting to deny an SSL cert.
[ Parent | on HN ]
Re:SSL certificate lifetimes are going down. Dates proposed.... by yugcesofni on Wednesday October 16, 2024 @12:18PM (#41860905)
FWIW, a slight clarification here would be that the majority of TLS certificates are issued by CAs in the US, but the majority of CAs are not headquartered in the US.
[ Parent | on HN ]