I'm creating a certificate authority for a network with a three level chain.
- level 1
- level 2
- level 3
- leaf certs.
I'm wondering what appropriate expire times are for each certificate in the chain. I will be managing certs with something like chef/salt and will also be providing ACME compatibility so we can assume that the logistics of actually updating the certs aren't a problem.
I want to update certificates frequently to prevent someone from incrementally expanding their attack surface. I also want to keep handling of the private key (offline linux machine, encypted flashdrive in a safe) to a minimum because I can't really enforce how other people handle it if the need arises.
Here is my first attempt at good expire times:
- Level 1: expires 2037
- Level 2: expires every 3 years
- Level 3: expires every 1 years
- Leaf Cert: expires every 3 months