5

Let's encrypt recently left beta and limits the maximal life-time of certificates to 90 days and recommends 60 days.

Now whenever I start talking about the issues of certificate revocation (e.g. OCSP soft-fails) I get to hear: "short lived certificates are probably the best solution".

So my question is:
Why are short-lived certificates a relatively recent trend and have not been deployed in the three decades before by the big CAs?

Note that in theory it's in the CAs best interest to deploy this, as they could actually save the heavily loaded OCSP servers and the earn enough money through certificates to develop a robust automatic certificate renewal tool.

3
  • Probably because server administrators would find it annoying to have to update their certificates every 2 months.
    – d0nut
    Apr 19, 2016 at 20:04
  • 1
    @iismathwizard "automated certificate management is a solved problem" and given the money behind CAs, I'm bound to believe that.
    – SEJPM
    Apr 19, 2016 at 20:06
  • mobile device management is a "solved problem" as well but not all enterprises have it.
    – d0nut
    Apr 19, 2016 at 20:21

1 Answer 1

5

It would be a huge operational cost in environments that don't have automated certificate management in place, which, in reality is the vast majority of the operational environments in the world today. In fact, in most environment little to nothing is automated. We've just started seeing people dip their toes in those waters in the past few years, and most mainstream organizations only in the past year or two.

So, when making a modification to server (like replacement a certificate) requires a purchase order, a manual deployment by a server admin, and a 4-6 week change management process, and you multiply that by, say 10,000 times for a moderately large-ish organization, short-lived certs go from being a challenge to an impossibility.

Certainly there are organizations (like Google, for instance) who have this nailed, at least on their public properties (I don't know if their enterprise systems get the same attention) and it will start to invade the mainstream with tools like Let's Encrypt's ACME client. But that hasn't existed for long, and there was nothing else out there before that made this easy for a organization that isn't sophisticated to implement. Add that to the fact that fake or stolen certificated haven't been a massively widespread or expensive problem organizations have needed to struggle with, and there wasn't really any incentive to invest in a solution. The real answer is to make short-lived certs cheaper and easier to manage than long-lived certs. That is when they'll take off, and why Let's Encrypt holds such great promise in this area.

2
  • What excites me about Let's Encrypt isn't that it's free, but that it promises to automate certificate management. Apr 19, 2016 at 20:29
  • @CodesInChaos Yep, that's critical. There have been CA's that have offered free certs in the past, with very little uptake. The automation is ground-breaking.
    – Xander
    Apr 19, 2016 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .