News for hackers. Stuff that matters.

A comment on Forthcoming OpenSSL releases. Parent comment

Re:Forthcoming OpenSSL releases by ad_hominem on Monday July 06, 2015 @12:55PM (#9840454)
I don't understand #1 - what prevents you from doing this today? When you generate a certificate you get to pick the expiration date; you are free to make it as short as you want. Don't intermediate certificates exist to implement this strategy?

edit: basically, what stops you from doing this?

Root CA root cert (20y expiration)

v

Root CA intermediate cert (10y expiration)

v

Your intermediate cert (1y expiration)

v

Your short-lived cert (24h expiration)

[ Parent | on HN ]
Re:Forthcoming OpenSSL releases by amluto on Monday July 06, 2015 @01:23PM (#9840672)
And who is going to issue you a reasonably-priced intermediate cert? Especially since PKIX name constraints don't actually work, so that intermediate cert would let you sign just about anything.
[ Parent | on HN ]
Re:Forthcoming OpenSSL releases by Hoff on Monday July 06, 2015 @01:55PM (#9840917)
For your own web servers and your own clients, use your own CA and your own certs.
[ Parent | on HN ]
Re:Forthcoming OpenSSL releases by eropple on Monday July 06, 2015 @02:04PM (#9840973)
This isn't a serious solution except for intranets--and this problem exists most pressingly on the internet to begin with.
[ Parent | on HN ]