Why do public certificates expire?

https://news.ycombinator.com/item?id=32060944

by AtNightWeCode • 4 years ago

2 9 4 years ago

news.ycombinator.com

A cert is in valid day 0 and day 0 + 1. Why is it valid day 730 but not day 730 + 1?

(No smart-asses, you now what I mean)

efortis5• 4 years ago

From Let's Encrypt:

1. They limit damage from key compromise and mis-issuance. Stolen keys and mis-issued certificates are valid for a shorter period of time.

https://letsencrypt.org/2015/11/09/why-90-days.html

---

For the same reason, having different certificates per server, when non-stateful balancing is an option, mitigates the decryption of all the traffic of a particular user on a given period. In other words, an adversary hoarding encrypted traffic has to break more certificates.

From: https://blog.uidrafter.com/isolated-tls-certificate-creation...

AtNightWeCode4• 4 years ago

“They limit damage from key compromise and miss-issuance. Stolen keys and miss-issued certificates are valid for a shorter period.”

I don’t buy this. Either it is secure day zero and day 10000000 or it is not secure. Why would I trust something day 730 and not day 731? That is basically a two-year period that someone can misuse something. Also, I would guess that more certs are compromised during changes than from actual installations.

efortis5• 4 years ago

Do you agree with the following?

As hardware gets more powerful, the easier it is to break older encryption standards. In other words, the algorithms and their key strength recommendations are related to the computational power available at a given time.

Why do public certificates expire?

Related Stories