News for hackers. Stuff that matters.

A comment on TLS Certificate Lifetimes Will Officially Reduce to 47 Days. Parent comment

Re:TLS Certificate Lifetimes Will Officially Reduce to 47 Days by Ajedi32 on Tuesday April 15, 2025 @11:52AM (#43694605)
It's a real shame. OCSP with Must-Staple seemed like the perfect solution to this, it just never got widespread support.

I suppose technically you can get approximately the same thing with 24-hour certificate expiry times. Maybe that's where this is ultimately heading. But there are issues with that design too. For example, it seems a little at odds with the idea of Certificate Transparency logs having a 24-hour merge delay.

[ Parent | on HN ]
Re:TLS Certificate Lifetimes Will Officially Reduce to 47 Days by lokar on Wednesday April 16, 2025 @12:51PM (#43707611)
The log is not really for real time use. It’s to catch CA non-compliance.
[ Parent | on HN ]
Re:TLS Certificate Lifetimes Will Officially Reduce to 47 Days by NoahZuniga on Wednesday April 16, 2025 @02:34PM (#43708817)
Also certificate transparency is moving to a new standard (sunlight CT) that has immediate merges. Google requires maximum merge delay to be 1 minute or less, but they've said on google groups that they expect merges to be way faster.
[ Parent | on HN ]