Technology

69156 readers

2999 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

198

TLS Certificate Lifetimes Will Officially Reduce to 47 Days (www.digicert.com)

submitted 5 days ago by [email protected] to c/[email protected]

53 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 12 points 5 days ago (1 children)

I just hope that automation doesn't bring new vulnerabilities... Otherwise we get safer cert but poorly secured automated PKI to create the certs?

I mean if you have a fully automated cert deployment it could be months with a compromised system and you probably wouldn't see it.

I don't know how effective this will be. It still seems short even if it starts in 2029.

[–] [email protected] 2 points 5 days ago (1 children)

How does manual cert generation impact that?

My experience is that orgs that don't bother checking logs are also likely to buy long duration certs. And it's also frequently a simple FTP drop or something, they're not taking the time to actually verify things properly.

I also haven't seem evidence of attackers compromising certificates themselves, if they have the access to do that, they'll just steal the data they want or install some kind of backdoor for later use.

[–] [email protected] 2 points 5 days ago

There is plenty of data on compromised certs. I mean if you steal a cert you essentially steal the identity of that server.

I'm just saying before that you had admins connecting from time to time to the server while deploying but after that change it could be years before someone connects. Cert deployment IMO is often one of the last maintenance that is not automated and one of the hardest to automate both safely and reliably.

But for a business that handles it that way it's just straight up an upgrade in security to have shorter certs.