Timeline for Should I change the private key when renewing a certificate?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 12, 2018 at 18:54 | comment | added | Thomas Pornin | @AlexWebr That should not make a difference. In modern networks, attackers who can eavesdrop are in good position to make an MitM attack as well, making the advantage of forward secrecy rather minor. | |
| Mar 12, 2018 at 18:27 | comment | added | user12048 | @ThomasPornin SSH has entirely forward-secret key exchanges, but SSL does not. Do you think that makes a difference in this argument? | |
| Jan 10, 2013 at 16:20 | comment | added | Thomas Pornin | Here we are talking about the server certificate, i.e. an End-entity certificate, not a CA certificate. Renewing a CA certificate while keeping the same key has the benefit of making it immediately applicable to certificates which were issued with the previous CA certificate, so it is nominally good and makes transitions smoother. It does make path construction a bit more complex, but implementations usually cope with it without any problem (it does confuse some network administrators, though). | |
| Jan 10, 2013 at 16:07 | comment | added | makerofthings7 | Does renewing a CA certificate (vs creating a new one) complicate path construction or validation? | |
| Jan 10, 2013 at 12:10 | history | answered | Thomas Pornin | CC BY-SA 3.0 |