192
Sysadmins slam Apple’s SSL/TLS cert lifespan cuts (www.theregister.com)
submitted 2 years ago by to c/technology@lemmy.world
81 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[+] -7 points 2 years ago (5 children)

Smells like you didn't read the article, it's an ongoing trend:

Max lifespans of certs have been gradually decreasing over the years in an ongoing effort to boost internet security. Prior to 2011, they could last up to about eight years. As of 2020, it's about 13 months.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 34 points 2 years ago (1 child)

    Reducing it to one year made sense, one year down to 10 days is actually a fucking massive difference. Practically speaking, it’s a far, far bigger change than 8 years down to 1.

    This isn’t just an “ongoing trend” at this point, it would be a fundamental change to the way that certificates are managed i.e. making it impossible to handle renewals manually for any decently sized business.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 26 points 2 years ago* (2 children)

    Thank you for the smug response however I did indeed read the article and going from 13 months to 10 days is not a trend but a complete rearchitecture of how certificates are managed.

    You have no idea how many orgs have to do this manually as their systems won’t enable it to be automated. Following a KBA once a year is fine for most (yet they still forget and websites break for a few days; this literally happened to NVD of all things a few weeks ago).

    This change is a 36x increase in effort with no consideration for those who can’t renew and apply certs programmatically / through automation.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 years ago

    This change is a 36x increase in effort with no consideration for those who can’t renew and apply certs programmatically / through automation

    Don't worry. All that old gear is at least 45 days old - so old - and isn't an apple product anyway probably. Ergo, support isn't their issue and you will have to take that up with your OEM because la-la-la-laaaaa, can't hear you. Wanna go ride bikes?

  • permalink
  • fedilink
  • source
  • parent
  • [–] -5 points 2 years ago

    I did indeed read the article

    Smells like Apple knows something but can’t say anything.

    Then do explain your conspiracy theory. Sectigo could go for a money grab, otherwise... probably just forcing automation without thinking of impact, as usual.

  • permalink
  • fedilink
  • source
  • parent