What is the benefit of having certificates expire at some fixed date?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
migrated from stackoverflow.com Feb 20 '12 at 15:10
|
Digital certificates are used to verify identities and affiliations online. People change jobs, students graduate, businesses fail or change ownership, private keys get leaked, and any number of other things may happen that would cause a particular certificate to stop being an accurate way to verify an identity. Certificates expire so that people using them can be sure that the information in them is at least somewhat up to date. |
|||
|
|
|
Same reason your driving licence expires. You may have existed last time you renewed, with that name, that address, that date of birth, that appearance, (and you may have been able to drive ;-)) but that state cannot rationally be expected to continue unchanged forever. So it has a renewal. Same applies to a digital certificate. It identifies an entity that exists, has a certain name, has a chain of CAs that are prepared to vouch for the next one down, etc ... None of that persists forever. |
|||
|
|
|
It's just because private keys can get stolen/compromised over time. So, if someone steals your key (e.g. a naughty employee who's leaving the company), their stolen key is only valuable for a limited time. Sure, you can revoke a certificate once you know it's been stolen, but if you don't realise it's been stolen, then expiration helps. HTH |
|||
|
|
