News for hackers. Stuff that matters.

A comment on Forthcoming OpenSSL releases. Parent comment

Re:Forthcoming OpenSSL releases by JoshTriplett on Monday July 06, 2015 @01:17PM (#9840623)
> 1) "hot" certificates with 24h ttl signed-off by a longer-living certificate on a more secure machine. Having 1-year certificate private key deployed on a web server is crazy. Especially since revocation does not really work.

This seems like the kind of thing that Let's Encrypt could be good at: if you have a fully automated renewal process, why have certificates last a long time?

[ Parent | on HN ]
Re:Forthcoming OpenSSL releases by amluto on Monday July 06, 2015 @01:22PM (#9840666)
It's the kind of thing that QUIC supports out of the box.
[ Parent | on HN ]
Re:Forthcoming OpenSSL releases by JoshTriplett on Monday July 06, 2015 @01:27PM (#9840709)
How so? What in QUIC makes it easier to have short-lived certificates?
[ Parent | on HN ]