I'm creating a certificate authority for a network with a three level chain.

  • level 1
  • level 2
  • level 3
  • leaf certs.

I'm wondering what appropriate expire times are for each certificate in the chain. I will be managing certs with something like chef/salt and will also be providing ACME compatibility so we can assume that the logistics of actually updating the certs aren't a problem.

I want to update certificates frequently to prevent someone from incrementally expanding their attack surface. I also want to keep handling of the private key (offline linux machine, encypted flashdrive in a safe) to a minimum because I can't really enforce how other people handle it if the need arises.

Here is my first attempt at good expire times:

  • Level 1: expires 2037
  • Level 2: expires every 3 years
  • Level 3: expires every 1 years
  • Leaf Cert: expires every 3 months
  • Expiration has more to do with key distribution than it does with security. The level one public keys are distributed to the client end, which often times is updated infrequently (decades with embedded clients). In this case, you're presumably handing distribution of client certs, so the expiration of the level 1 cert should be based on how long you expect to update those keys. – Steve Sether Jun 16 '17 at 15:55
  • 3
    I would assume that you had a reason to create a PKI with three levels instead of for example a single level or two level. If you would provide the reasons which led to this decision one could probably learn about the risk assessment you did, about your security requirements, the number of certificates you want to issue, how many you expect to revoke etc which also influence how often you should reissue a new chain CA. Unless of course you've just did a three level deep PKI without any particular reason in which case just pick random expiration times for the same no reason. – Steffen Ullrich Jun 16 '17 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.