Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There is no limitation in TLS preventing you from cycling your keys every 24 hours. Most CAs let you do unlimited reissuance. It makes public key pinning hard (impossible?), though.


This doesn't really work without the certificate expiration date also being 24-48h in the future, though.

I think they reissue the same 1y+ validity cert...


Some allow manually specifying the expiration times.


Entrust, for instance, allows you to purchase certs essentially on a subscription plan. You may have one valid cert for 3 years (and pay the reduced 3 year rate), and reissue it with 24 hour expirations every day.

I personally wouldn't go with an expiration that low because of the operational overhead, but a few weeks or a month is attractive. It still significantly limits the downside potential versus 1-3 year certs. Basically any cert (non-root) over 1 year should be considered against best practice at this point.


> It makes public key pinning hard (impossible?), though.

In this case you don't pin the server's key but the "central" key.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: