Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have the following scenario:
When the leaf certificate expires, the intermediate certificate is checked and if the intermediate is not expired, the application will keep running and will not be affected, while the leaf is getting updated.
It is like adding a condition to check the validity of the intermediate certificate in the step of checking the validity of the leaf certificate.
Is something like this possible? If so, will there be any security problems with doing this?
What you're asking is basically "is it safe to ignore leaf expiry". Officially, the answer is "probably not". For example, the reason that I have to get Let's Encrypt to re-certify my web server's keypair every 90 days is that revocation infrastructure/process is generally abysmal, even for applications that do attempt to implement it. Clients' refusal to respect long-lived leaf keys is a "stop-gap" mitigation of this.
If your server's TLS private key ever gets compromised, configuring your client applications to ignore leaf expiry like you're proposing would basically change the attacker's window of usefulness from ≤90d to up to 5 years, assuming (and I think this likely) you don't have any serious process in place for getting revocation notices of compromised keys' certificates to the clients.
Is something like this possible?
In your application you can implement any logic you want. But you should understand the consequences. The traffic of your application will not be secure.
Expiration date is needed to reduce the probability of certificate compromising. If the certificate is expired, the application cannot know if a new certificate is ordered. If certificate is expired, how long do you want your application to trust it? A minute, an hour, a year, 10 years?
The proper way to avoid downtime because of expired certificates is to order the next certificate in advance. Its validity period should begin when the old one ends, or usually a few days earlier. You install new certificate and remove the old one. Thus you avoid an TLS downtime.
