Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

See title. Are there any sources where there are recommended validity times of certificates (based on length, algo, etc)?

I'm particularly interested in validity of RSA certificates...

share|improve this question

1 Answer

up vote 2 down vote accepted

There's some info in the Microsoft blog:

Key length of 1024:  Validity period = not greater than 6-12 months
Key length of 2048:  Validity period = not greater than 2 years
Key length of 4096:  Validity period = not greater than 16 years

Edit :) ok, so let's try some more:

There is this recomendation from US government that says that shouldn't be longer than 3 years. And the validity period should be related to the interaction necessary to "renew" it: the more human interation is necessary, the longer the time, up to 3 years.

In Brazil, the recomendation is: source

  • 1024 bits, software generated: 1 year if stored in software and 2 years if in hardware (token)

  • 1024 bits, hardware generated: 3 years if stored in hardware

share|improve this answer
+1 for finding the same source as I already did :-) Any others? – eckes Mar 2 '12 at 12:53
"Interaction needed to renew" <-- is a usability measurement not a security measurement. For a security point of view it's literally how long can we be sure of the same key-pair without compromise. – ewanm89 Mar 2 '12 at 22:24
One last thing, to put on the android market the developer key needs a 22 Oct 2033 minimum expiry date! – ewanm89 Mar 2 '12 at 22:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.