News for hackers. Stuff that matters.

A comment on TLS Certificate Lifetimes Will Officially Reduce to 47 Days. Parent comment

Re:TLS Certificate Lifetimes Will Officially Reduce to 47 Days by EE84M3i on Tuesday April 15, 2025 @07:56PM (#43699846)
Yes but this still depends on identity. It's not unauthenticated.
[ Parent | on HN ]
Re:TLS Certificate Lifetimes Will Officially Reduce to 47 Days by ekr____ on Wednesday April 16, 2025 @01:52PM (#43708386)
The situation is actually somewhat more complicated than this.

ECH gets the key from the DNS, and there's no real authentication for this data (DNSSEC is rare and is not checked by the browser). See S 10.2 [0] for why this is reasonable.

[0] https://tlswg.org/draft-ietf-tls-esni/draft-ietf-tls-esni.ht...

[ Parent | on HN ]