• hsdkfr734r@feddit.nl
    link
    fedilink
    English
    arrow-up
    87
    ·
    7 days ago

    When I look at the default list of trusted CAs in my browser, I get the feeling that certificate lifetimes isn’t the biggest issue with server certificates.

    • rottingleaf@lemmy.world
      link
      fedilink
      English
      arrow-up
      25
      arrow-down
      3
      ·
      7 days ago

      People who’d abuse trust into centralized PKI system are not real, they can’t hurt you, because if they abuse it, said system’s reputation will fall to zero, right?

      Except it’s being regularly abused. LOL. And everybody is using it.

    • errer@lemmy.world
      link
      fedilink
      English
      arrow-up
      20
      ·
      6 days ago

      The sites I have most frequently have had to add expired certificates to use are US government websites. Particularly those affiliated with the military branches. It’s sad.

    • jagged_circle@feddit.nl
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      3
      ·
      6 days ago

      Yes X.509 is broken. If you’re a developer and not pinning certs, you’re doing it wrong.

        • jagged_circle@feddit.nl
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          12
          ·
          edit-2
          6 days ago

          What part are you confused about, and are you a developer?

          Edit: why was I downvoted for asking this?

      • oldfart@lemm.ee
        link
        fedilink
        English
        arrow-up
        3
        ·
        6 days ago

        Yeah, now imagine pinning certs that change weekly.

        My first thought is that old school secure software (like claws-mail) treats a cert change as a minor security incident, asking you to confirm every time. Completely different school of thought.